Skip to content
Heist/ feed
Unrated

Malicious code in csv-parser-helper (npm)

Type: advisorySource: OSV1 source record

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (90b87a86eaa4be59def7e48ce9b004266b8c4815a71c84fd1d3df879c702c1ca) The package is advertised as a CSV parser but ships a postinstall.js that runs on `npm install` and performs installer-side reconnaissance and exfiltration. It shell-collects hostname, current user, working directory, `uname -a`, container indicators, process tree, and network information; probes AWS and Tencent instance metadata services at 169.254.169.254 and metadata.tencentyun.com; and dumps the full process environment while filtering out only npm noise (retaining any token/secret-shaped variables such as GITHUB_TOKEN, cloud provider keys, and CI credentials). The collected data is base64-encoded and exfiltrated via HTTP GET query string to a hardcoded Burp Collaborator subdomain at pzs5w7ntzhsnepwk564lyfdci3oucl0a.oastify.com. The package's stated CSV-parsing purpose is a cover story — index.js is unrelated code and no CSV functionality is present.

Announced Source revision 1
Original source ↗

MAL-2026-12360

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:MAL-2026-12360

csv-parser-helper

Source reference: /affected/0/package/name

Affected versions
1.0.0

Source reference: /affected/0/versions

Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "package": {
      "name": "csv-parser-helper",
      "purl": "pkg:npm/csv-parser-helper",
      "ecosystem": "npm"
    },
    "versions": [
      "1.0.0"
    ],
    "database_specific": {
      "cwes": [
        {
          "name": "Embedded Malicious Code",
          "cweId": "CWE-506",
          "description": "The product contains code that appears to be malicious in nature."
        }
      ],
      "source": "https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/csv-parser-helper/MAL-2026-12360.json",
      "indicators": {
        "evidence_files": [
          {
            "path": "postinstall.js",
            "tlsh": "8931fbf8b56ded72304dc5f8b75d14053846eaeb58e4ff74281b8875008e48420a9136",
            "sha256": "5826f6884581fbfa40d0793ff4c4b6f3b4e5e0a704bfd87bf7c4e3ec274b2ec9"
          }
        ],
        "package_integrity": [
          {
            "hashes": {
              "sha1": "8c59ca801f11e1ffa9fc29aaf7ade649b9cba428",
              "sha512_sri": "sha512-crpnaO+txiJ9xoMLQVjCn/BZlIKaraujwrD3WgPHZwk0jInKKlOGtgKJ74Hq2xXhPLPCUi20NAgcz8w36yoT4Q=="
            },
            "filename": "csv-parser-helper-1.0.0.tgz"
          }
        ]
      }
    }
  }
]

Publisher severity

No explicit severity was provided.

Event
#10969 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement