Skip to content
Heist/ feed
Unrated

Malicious code in @sapappgyver/appgyver-descriptors (npm)

Type: advisorySource: OSV1 source record

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (f9396712a6bf4b08219d9ed2066ebf8c25a7558b988b6d9bf1c9ae57349a4741) The package declares an `install` lifecycle script that runs `node index.js`, which requires `lib/core.js`; the same module is the package main, so the payload also fires on any `require()` of the package. `lib/core.js` reads the installer's OS username, hostname, and current working-directory basename and encodes them as labels of a DNS subdomain under `oob.sl4x0.xyz`, then issues a `dns.resolve4` lookup — leaking host and user identity to an author-controlled authoritative resolver. Sibling files `lib/b02e30.js` and `lib/6ad264.js` hide the module names (`os`, `dns`, `process`), the property names (`userInfo`, `hostname`, `cwd`, `resolve4`), and the destination host `oob.sl4x0.xyz` as arrays of char-code hex literals reconstructed with `String.fromCharCode` at runtime. The package name `@sapappgyver/appgyver-descriptors` is crafted to visually match SAP's legitimate `@sap/appgyver-*` scope; the repository `github.com/slaxorg/nms-dashboard-js` and author email `research@sl4x0.xyz` have no relation to SAP and align with the exfil domain. ## Source: ghsa-malware (6e79ffb8d947778e6d69ab9a9f110c80cdab56529f7461099053d28bb28d6ebb) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. Th

Announced Source revision 1
Original source ↗

MAL-2026-12507

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:MAL-2026-12507

@sapappgyver/appgyver-descriptors

Source reference: /affected/0/package/name

Affected versions
9.9.11

Source reference: /affected/0/versions

9.9.0

Source reference: /affected/0/versions

Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "ranges": [
      {
        "type": "SEMVER",
        "events": [
          {
            "introduced": "0"
          }
        ]
      }
    ],
    "package": {
      "name": "@sapappgyver/appgyver-descriptors",
      "purl": "pkg:npm/%40sapappgyver/appgyver-descriptors",
      "ecosystem": "npm"
    },
    "versions": [
      "9.9.11",
      "9.9.0"
    ],
    "database_specific": {
      "cwes": [
        {
          "name": "Embedded Malicious Code",
          "cweId": "CWE-506",
          "description": "The product contains code that appears to be malicious in nature."
        },
        {
          "name": "Embedded Malicious Code",
          "cweId": "CWE-506",
          "description": "The product contains code that appears to be malicious in nature."
        },
        {
          "name": "Embedded Malicious Code",
          "cweId": "CWE-506",
          "description": "The product contains code that appears to be malicious in nature."
        }
      ],
      "source": "https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@sapappgyver/appgyver-descriptors/MAL-2026-12507.json",
      "indicators": {
        "evidence_files": [
          {
            "path": "lib/core.js",
            "tlsh": "38014929a393c08f97e096d0361a03d18499c380e7ce80a5fa7c4a87904e7d1cac5a96",
            "sha256": "397d1435e7291ed6b02b8627033a110124d250a54290b3a8f9f248573fd6a2d4"
          },
          {
            "path": "lib/b02e30.js",
            "tlsh": "eae068073313c94fa1880bf77a0050a0ba4d8b5ca21dc0d6b528678500af443c0c0232",
            "sha256": "6c99eaab00a041e398c8732c1113d6e881ec0c4f7cc6ef3b14412946c8cb5258"
          },
          {
            "path": "package.json",
            "tlsh": "77215b35ce254c236ec86aa4dc692a42f5a24c174d407c1933c7a12c8faf2af52ff65d",
            "sha256": "b3e2432a3c374b2d2554e34f8e8a3b037218bbb2c6591756ade92ac757a58b7c"
          }
        ],
        "package_integrity": [
          {
            "hashes": {
              "sha1": "067f5800a83aa34fe65f78961effa59a68bcbfc0",
              "sha512_sri": "sha512-GljfQF8oujBYvuHJFKfrHazxEVcRi+eIH6WYJ5nhjxt4doKMZnOQ2LmSAW1CjQyMJ+gv/reI/J0QwiFd1zoIng=="
            },
            "filename": "appgyver-descriptors-9.9.11.tgz"
          }
        ]
      }
    }
  }
]

Publisher severity

No explicit severity was provided.

Event
#13626 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement