Malicious code in @inpeek/odata-angular (npm)
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (914508dbfa95a3d2cef5aef321a656215797f477c161a8c234e76256db6cac65) @inpeek/odata-angular@99.99.102 is a dependency-confusion squat on the private @inpeek scope, published to the public npm registry at an inflated version (99.99.102) to win resolution against an internal package of the same name. package.json declares scripts.postinstall as 'node./ping.js'; ping.js issues an HTTPS GET to the third-party collector https://db1b65hgnouukn3qov9gta83zgkdao9dy.oast.me/ carrying os.hostname(), os.platform(), process.version, and the package name as query parameters. index.js throws on require, so the package has no legitimate library function; the only install-time effect is the beacon to the external OAST domain. Any CI job or developer workstation whose resolver picks @inpeek/* from the public registry executes the beacon on npm install and leaks host identifiers to an attacker-controlled destination, regardless of a 'bug bounty research' framing in the description. ## Source: ghsa-malware (49aa22130475d20e46d4e44535bad948c0a265631daf1be075d22aa3e202844c) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the
MAL-2026-17543
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:MAL-2026-17543
@inpeek/odata-angular
Source reference: /affected/0/package/name
- Affected versions
- 99.99.102
Source reference:
/affected/0/versions99.99.101Source reference:
/affected/0/versions99.99.100Source reference:
/affected/0/versions99.99.99Source reference:
/affected/0/versions - Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"package": {
"name": "@inpeek/odata-angular",
"purl": "pkg:npm/%40inpeek/odata-angular",
"ecosystem": "npm"
},
"versions": [
"99.99.102",
"99.99.101",
"99.99.100",
"99.99.99"
],
"database_specific": {
"cwes": [
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
},
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
},
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
},
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
},
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
}
],
"source": "https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@inpeek/odata-angular/MAL-2026-17543.json",
"indicators": {
"evidence_files": [
{
"path": "ping.js",
"tlsh": "923165bb2691437017e802e97355685a9687f11ad8516dc4b9cf12a84bc11eb22216f3",
"sha256": "78fb048f90c93454692a1e2e94d9bf46ad326d6a2185f77d65d0512cf7f47e59"
},
{
"path": "package.json",
"tlsh": "26f00c6cd9649d7222ec4ae5083a0001f0292e8fd840bc0a3adb100d2b5e4eb52bc26e",
"sha256": "13e86c3c0e553f6263d1bcc34b395a3cd2a7e9289fa93c8793f1008fe31eba09"
}
],
"package_integrity": [
{
"hashes": {
"sha1": "2e924a917d2a4cba6db8caeab2f29d38b543ff4d",
"sha512_sri": "sha512-XlANCqmhtnhble32RUUyGMiFZC3pbTLqVG/1sE+Gh7A60031p4G0v0qYgSeVLiSd4Dm2ufyPOJnEdoGMJRkx1Q=="
},
"filename": "odata-angular-99.99.102.tgz"
}
]
}
}
}
]Publisher severity
No explicit severity was provided.
- Event
- #85813 · Revision 1
- Added to Heist Feed
- Publisher date