Malicious code in messenger-style (npm)
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (48e89235ade6dcbf682edae5afb7d789c6a834b2ebe032fac72c796734837d10) The package's preinstall hook runs `node index.js`, which collects host identifiers (`os.hostname()`, `os.userInfo().username`, home directory, DNS servers) and reads `/etc/passwd` and `/etc/hosts` from the installer's machine, then POSTs the collected data over HTTPS to the hardcoded host `pkdzrreksftymvx4d0o5olnxiooic80x.oastify.com` (a Burp Collaborator out-of-band interaction domain). The package name suggests a messaging utility, but no such functionality is present — the sole behavior on `npm install` is host reconnaissance and exfiltration to an attacker-controlled OAST endpoint.
MAL-2026-12796
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:MAL-2026-12796
messenger-style
Source reference: /affected/0/package/name
- Affected versions
- 1.0.1
Source reference:
/affected/0/versions - Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"package": {
"name": "messenger-style",
"purl": "pkg:npm/messenger-style",
"ecosystem": "npm"
},
"versions": [
"1.0.1"
],
"database_specific": {
"cwes": [
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
}
],
"source": "https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/messenger-style/MAL-2026-12796.json",
"indicators": {
"evidence_files": [
{
"path": "index.js",
"tlsh": "ae41259992d917330de210c0660c70843359fa777259999076cf42d6af869f8b7326f3",
"sha256": "d5430414b2826cc5db00f9f5ae556e542997c6c46d3bd7f2b440c0d2f5de4514"
}
],
"package_integrity": [
{
"hashes": {
"sha1": "406b89c9b49b7134dbfa6efd620a7a5e87edb627",
"sha512_sri": "sha512-ukrk9WgR4OYXOyIxZOuZyrUdZP9VcjJpZFL6cY60ZqjNeUlTwMljjV2FsmNoKcWPtmjXgqOXbBZ2lLyr0qygCQ=="
},
"filename": "messenger-style-1.0.1.tgz"
}
]
}
}
}
]Publisher severity
No explicit severity was provided.
- Event
- #10995 · Revision 1
- Added to Heist Feed
- Publisher date