Malicious code in csv-parser-helper (npm)
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (90b87a86eaa4be59def7e48ce9b004266b8c4815a71c84fd1d3df879c702c1ca) The package is advertised as a CSV parser but ships a postinstall.js that runs on `npm install` and performs installer-side reconnaissance and exfiltration. It shell-collects hostname, current user, working directory, `uname -a`, container indicators, process tree, and network information; probes AWS and Tencent instance metadata services at 169.254.169.254 and metadata.tencentyun.com; and dumps the full process environment while filtering out only npm noise (retaining any token/secret-shaped variables such as GITHUB_TOKEN, cloud provider keys, and CI credentials). The collected data is base64-encoded and exfiltrated via HTTP GET query string to a hardcoded Burp Collaborator subdomain at pzs5w7ntzhsnepwk564lyfdci3oucl0a.oastify.com. The package's stated CSV-parsing purpose is a cover story — index.js is unrelated code and no CSV functionality is present.
MAL-2026-12360
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:MAL-2026-12360
csv-parser-helper
Source reference: /affected/0/package/name
- Affected versions
- 1.0.0
Source reference:
/affected/0/versions - Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"package": {
"name": "csv-parser-helper",
"purl": "pkg:npm/csv-parser-helper",
"ecosystem": "npm"
},
"versions": [
"1.0.0"
],
"database_specific": {
"cwes": [
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
}
],
"source": "https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/csv-parser-helper/MAL-2026-12360.json",
"indicators": {
"evidence_files": [
{
"path": "postinstall.js",
"tlsh": "8931fbf8b56ded72304dc5f8b75d14053846eaeb58e4ff74281b8875008e48420a9136",
"sha256": "5826f6884581fbfa40d0793ff4c4b6f3b4e5e0a704bfd87bf7c4e3ec274b2ec9"
}
],
"package_integrity": [
{
"hashes": {
"sha1": "8c59ca801f11e1ffa9fc29aaf7ade649b9cba428",
"sha512_sri": "sha512-crpnaO+txiJ9xoMLQVjCn/BZlIKaraujwrD3WgPHZwk0jInKKlOGtgKJ74Hq2xXhPLPCUi20NAgcz8w36yoT4Q=="
},
"filename": "csv-parser-helper-1.0.0.tgz"
}
]
}
}
}
]Publisher severity
No explicit severity was provided.
- Event
- #10969 · Revision 1
- Added to Heist Feed
- Publisher date