Malicious code in radio-player-theme (npm)
`radio-player-theme` presents itself as a radio player theme. The published tarball contains three files: `package.json`, `style.css` (declared as `main`) and `payload.js`, which holds the package's only executable code. `payload.js` is a browser payload. On execution it reads `location.origin` and `document.cookie`, extracts the value of a `MANAGER-XSRF-TOKEN` cookie, and sends the origin together with the collected state to an out-of-band callback domain under `oastify.com` by assigning it to an `Image.src`. It then issues a second authenticated request to a third-party manager API and writes the collected data to `window.__radioXssProof`. The file carries a comment describing itself as a bug bounty proof of concept for a CSP bypass through a public CDN that serves npm packages. Regardless of that claim, the published package delivers working data-collection code to anyone who loads it, and the package has no other function. The package declares no install hooks, so `npm install` alone does not execute the payload; the code runs when the file is loaded in a browser, which is what CDN delivery of an npm package enables. Evidence: `payload.js:7` holds the hardcoded callback domain; `payload.js:13-19` perform the cookie read and the beacons. Determination: manual review of the published tarball (sha256 `ddbb93aa9416c1c89cf15dc7627f4a816a1c31929238ed8608264546ba0df186`). --- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (6d9e0f0ee96d95fb59c
- Products
- radio-player-theme
- Affected versions
- 0.0.0-stage, 1.0.0, 2.0.0, 3.0.0, 4.0.0, 5.0.0, 6.0.0
- Fixed versions
- Not specified
- CVEs
- Not specified
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 28 Oct 2026, 09:00 UTC · Revision 1
Source evidence
Malicious code in radio-player-theme (npm)
core-osv · Original sourcePublished 19 Sept 2026, 21:26 UTC
`radio-player-theme` presents itself as a radio player theme. The published tarball contains three files: `package.json`, `style.css` (declared as `main`) and `payload.js`, which holds the package's only executable code. `payload.js` is a browser payload. On execution it reads `location.origin` and `document.cookie`, extracts the value of a `MANAGER-XSRF-TOKEN` cookie, and sends the origin together with the collected state to an out-of-band callback domain under `oastify.com` by assigning it to an `Image.src`. It then issues a second authenticated request to a third-party manager API and writes the collected data to `window.__radioXssProof`. The file carries a comment describing itself as a bug bounty proof of concept for a CSP bypass through a public CDN that serves npm packages. Regardless of that claim, the published package delivers working data-collection code to anyone who loads it, and the package has no other function. The package declares no install hooks, so `npm install` alone does not execute the payload; the code runs when the file is loaded in a browser, which is what CDN delivery of an npm package enables. Evidence: `payload.js:7` holds the hardcoded callback domain; `payload.js:13-19` perform the cookie read and the beacons. Determination: manual review of the published tarball (sha256 `ddbb93aa9416c1c89cf15dc7627f4a816a1c31929238ed8608264546ba0df186`). --- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (6d9e0f0ee96d95fb59c
osv:MAL-2026-16347
radio-player-theme
Fixed versions: Not specified
Complete source record
{
"id": "4ef042b9376e7761726cb9b00ea4ce64c7a164539ab3efff0af8f522820b0957",
"url": "https://osv.dev/vulnerability/MAL-2026-16347",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Malicious code in radio-player-theme (npm)",
"summary": "`radio-player-theme` presents itself as a radio player theme. The published tarball contains three files: `package.json`, `style.css` (declared as `main`) and `payload.js`, which holds the package's only executable code. `payload.js` is a browser payload. On execution it reads `location.origin` and `document.cookie`, extracts the value of a `MANAGER-XSRF-TOKEN` cookie, and sends the origin together with the collected state to an out-of-band callback domain under `oastify.com` by assigning it to an `Image.src`. It then issues a second authenticated request to a third-party manager API and writes the collected data to `window.__radioXssProof`. The file carries a comment describing itself as a bug bounty proof of concept for a CSP bypass through a public CDN that serves npm packages. Regardless of that claim, the published package delivers working data-collection code to anyone who loads it, and the package has no other function. The package declares no install hooks, so `npm install` alone does not execute the payload; the code runs when the file is loaded in a browser, which is what CDN delivery of an npm package enables. Evidence: `payload.js:7` holds the hardcoded callback domain; `payload.js:13-19` perform the cookie read and the beacons. Determination: manual review of the published tarball (sha256 `ddbb93aa9416c1c89cf15dc7627f4a816a1c31929238ed8608264546ba0df186`). --- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (6d9e0f0ee96d95fb59c",
"evidence": "osv:MAL-2026-16347",
"products": [
{
"name": {
"value": "radio-player-theme",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "6.0.0",
"evidence": "/affected/0/versions"
},
{
"value": "2.0.0",
"evidence": "/affected/0/versions"
},
{
"value": "3.0.0",
"evidence": "/affected/0/versions"
},
{
"value": "5.0.0",
"evidence": "/affected/0/versions"
},
{
"value": "4.0.0",
"evidence": "/affected/0/versions"
},
{
"value": "0.0.0-stage",
"evidence": "/affected/0/versions"
},
{
"value": "1.0.0",
"evidence": "/affected/0/versions"
}
]
}
],
"severity": "unknown",
"structured": {
"id": "MAL-2026-16347",
"aliases": [
"GHSA-pp2v-g64w-gm6f",
"MAL-2026-16347"
],
"affected": [
{
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "radio-player-theme",
"purl": "pkg:npm/radio-player-theme",
"ecosystem": "npm"
},
"versions": [
"6.0.0",
"2.0.0",
"3.0.0",
"5.0.0",
"4.0.0",
"0.0.0-stage",
"1.0.0"
],
"database_specific": {
"cwes": [
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
},
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
},
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
},
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
},
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
},
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
},
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
},
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
}
],
"source": "https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/radio-player-theme/MAL-2026-16347.json",
"indicators": {
"evidence_files": [
{
"path": "package.json",
"tlsh": "46d0a7144620e23719c5d7a51d3557057f3a091f2a80b528576f603c832c6b22af2bae",
"sha256": "456b72fd8125a78cc87af7c540e4796a81c89a470d9d99820fb2800b87b95502"
}
],
"package_integrity": [
{
"hashes": {
"sha1": "49ae50d19d52afd716bb9de2abe17426e46f2f45",
"sha512_sri": "sha512-osQY61hOThLZJWDzfCufIEfPkD7anZ6/gMDeOIZuRHWvXkRUUFBS9U5EjQOvM52+5pNUNirqpCttGqURJX6dnA=="
},
"filename": "radio-player-theme-6.0.0.tgz"
}
]
}
}
}
],
"modified": "2026-10-08T06:45:19.281578274Z",
"provider": "osv",
"references": [
"https://www.npmjs.com/package/radio-player-theme/v/6.0.0",
"https://github.com/advisories/GHSA-pp2v-g64w-gm6f",
"https://www.npmjs.com/package/radio-player-theme/v/2.0.0",
"https://www.npmjs.com/package/radio-player-theme/v/3.0.0",
"https://www.npmjs.com/package/radio-player-theme/v/5.0.0",
"https://www.npmjs.com/package/radio-player-theme/v/4.0.0",
"https://www.npmjs.com/package/radio-player-theme/v/0.0.0-stage",
"https://www.npmjs.com/package/radio-player-theme/v/1.0.0"
],
"provider_metadata": {
"iocs": {
"files": [
{
"note": "Browser payload: reads location.origin and document.cookie, extracts the MANAGER-XSRF-TOKEN value, and beacons the collected state to the callback domain.",
"paths": [
"package/payload.js"
],
"source": "PACKAGE_ARCHIVE",
"digests": {
"sha256": "37f83798b08b0c645ceacab72c1693340ab187a1411a0bd9d3164d1313798901"
}
}
],
"domains": [
"bfuntjuvcnxl49hcbpklk3ube2ks8h.oastify.com"
]
},
"malicious-packages-origins": [
{
"id": "IN-MAL-2026-020425",
"sha256": "6d9e0f0ee96d95fb59c2b3cfb30cfad6e32db8112eab806c63eda8f703e43d12",
"source": "amazon-inspector",
"versions": [
"6.0.0"
],
"import_time": "2026-09-23T04:22:29.675426053Z",
"modified_time": "2026-09-23T04:21:15Z"
},
{
"id": "GHSA-pp2v-g64w-gm6f",
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "0"
}
]
}
],
"sha256": "634bf43fdaf0896cad38e5db9b7007dbae2994df1f00bcaa9c9098aa3f9eabb4",
"source": "ghsa-malware",
"import_time": "2026-09-30T06:43:04.839094368Z",
"modified_time": "2026-09-30T05:30:39Z"
},
{
"id": "IN-MAL-2026-021189",
"sha256": "ac59050c69a059ccbb4828cc512198d666cc4282137584fd581b7e2c4870b8de",
"source": "amazon-inspector",
"versions": [
"2.0.0"
],
"import_time": "2026-10-08T06:34:04.815637676Z",
"modified_time": "2026-10-08T06:09:58Z"
},
{
"id": "IN-MAL-2026-021187",
"sha256": "1b06a29500e6c074210ad1cb7ab69395e7b16960ee79bcf5963043811c680898",
"source": "amazon-inspector",
"versions": [
"3.0.0"
],
"import_time": "2026-10-08T06:34:04.66653189Z",
"modified_time": "2026-10-08T06:09:43Z"
},
{
"id": "IN-MAL-2026-021188",
"sha256": "3ba337ffad127a123b1a54e7fa5109d8f9384711338b10b6965c6a9ed9435db4",
"source": "amazon-inspector",
"versions": [
"5.0.0"
],
"import_time": "2026-10-08T06:34:04.769474777Z",
"modified_time": "2026-10-08T06:09:51Z"
},
{
"id": "IN-MAL-2026-021186",
"sha256": "43c53af78e79cba2d6459a1a5a502cc35af3402aaf5d82588b08c08b8db67922",
"source": "amazon-inspector",
"versions": [
"4.0.0"
],
"import_time": "2026-10-08T06:34:04.606373441Z",
"modified_time": "2026-10-08T06:09:33Z"
},
{
"id": "IN-MAL-2026-021191",
"sha256": "6682bcd694331c3dd7ef72879df2a21474ea53c17d5e3d287269d995eeea577a",
"source": "amazon-inspector",
"versions": [
"0.0.0-stage"
],
"import_time": "2026-10-08T06:34:04.92657942Z",
"modified_time": "2026-10-08T06:10:15Z"
},
{
"id": "IN-MAL-2026-021192",
"sha256": "6be9ec366372f8ecd58426e6f5c6eb44b9d889bead2617c07093ea7ce4b767e4",
"source": "amazon-inspector",
"versions": [
"1.0.0"
],
"import_time": "2026-10-08T06:34:05.006470399Z",
"modified_time": "2026-10-08T06:10:24Z"
}
]
}
},
"related_cves": [],
"security_relevant": true,
"severity_evidence": null
},
"source_id": "core-osv",
"document_id": 98615,
"published_at": "2026-09-19T21:26:22+00:00"
}