Malicious code in ksp-client-registry (npm)

{
  "id": "3c12da9a0dd06a35e6c6b518ecd96a1b8bba74873eeeb56dcd95d1deffce756d",
  "url": "https://osv.dev/vulnerability/MAL-2026-17771",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Malicious code in ksp-client-registry (npm)",
    "summary": "--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (3b11a639f5149e4b1c17e64eb78f226abece5ed03152b5933333a3cb56284018) The npm package ksp-client-registry@100.100.100 ships a prebuilt native addon at prebuilds/linux-x64/addon.node that is loaded by the package main (index.js require of./prebuilds/linux-x64/addon). On load the addon reads the HOSTNAME, npm_package_name, and npm_config_registry environment variables and opens a raw TCP socket to the hardcoded IP 64.181.165.115, sending them in an HTTP request of the form 'POST /dc HTTP/1.0' with a body shaped as 'h=&p=&u=&r='. ELF strings corroborate the behavior: '64.181.165.115', 'POST /dc HTTP/1.0', 'Host: 64.181.165.115', 'HOSTNAME', 'npm_package_name', 'npm_config_registry', and imports of socket/connect/send/fork/getenv/inet_pton. package.json declares a postinstall ('node postinstall.js') providing an install-time footprint, and any require() of the package triggers the beacon regardless. The addon exposes no legitimate N-API functionality beyond module registration. The implausibly high version (100.100.100) and generic registry-style name are consistent with a dependency-confusion probe designed to be resolved in place of an internal package and to report back the victim host, internal package name, and configured registry URL to the operator.",
    "evidence": "osv:MAL-2026-17771",
    "products": [
      {
        "name": {
          "value": "ksp-client-registry",
          "evidence": "/affected/0/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": [
          {
            "value": "100.100.100",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "100.100.101",
            "evidence": "/affected/0/versions"
          }
        ]
      }
    ],
    "severity": "unknown",
    "structured": {
      "id": "MAL-2026-17771",
      "aliases": [
        "MAL-2026-17771"
      ],
      "affected": [
        {
          "package": {
            "name": "ksp-client-registry",
            "purl": "pkg:npm/ksp-client-registry",
            "ecosystem": "npm"
          },
          "versions": [
            "100.100.100",
            "100.100.101"
          ],
          "database_specific": {
            "cwes": [
              {
                "name": "Embedded Malicious Code",
                "cweId": "CWE-506",
                "description": "The product contains code that appears to be malicious in nature."
              },
              {
                "name": "Embedded Malicious Code",
                "cweId": "CWE-506",
                "description": "The product contains code that appears to be malicious in nature."
              }
            ],
            "source": "https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/ksp-client-registry/MAL-2026-17771.json",
            "indicators": {
              "evidence_files": [
                {
                  "path": "prebuilds/linux-x64/addon.node",
                  "tlsh": "c272761bb761c93bc4e853389497466572f2a470777243232f00a17a2cd37889ebbd5a",
                  "sha256": "d1ecb9d24c13b9a47b3fc19036fee676e13c65af1df61b8d61bd9ec8aadeb906"
                },
                {
                  "path": "package.json",
                  "tlsh": "28d012144e229a3339c547a99d27950a59720e5f5144b81813a325ad42d9bbb4cbf31e",
                  "sha256": "e1a888bd3962ef93dd6daed6e141905ef006bd17be71d537875ffb26a2c9c971"
                }
              ],
              "package_integrity": [
                {
                  "hashes": {
                    "sha1": "5aca2fa379d08067aa6aa3f1c79bf09302e2c3c1",
                    "sha512_sri": "sha512-t9/b9p6Xq6rhb3TqM30Kr+Ue06kAx1As9cXBCaX4aWl7LUsEA+m9m4IBrTxX2pwB86JmIOIeweOirmVWkPqcOQ=="
                  },
                  "filename": "ksp-client-registry-100.100.100.tgz"
                }
              ]
            }
          }
        }
      ],
      "modified": "2026-10-11T14:30:09.171471533Z",
      "provider": "osv",
      "references": [
        "https://www.npmjs.com/package/ksp-client-registry/v/100.100.100",
        "https://www.npmjs.com/package/ksp-client-registry/v/100.100.101"
      ],
      "provider_metadata": {
        "malicious-packages-origins": [
          {
            "id": "IN-MAL-2026-021422",
            "sha256": "3b11a639f5149e4b1c17e64eb78f226abece5ed03152b5933333a3cb56284018",
            "source": "amazon-inspector",
            "versions": [
              "100.100.100"
            ],
            "import_time": "2026-10-11T14:18:04.311865673Z",
            "modified_time": "2026-10-11T13:57:03Z"
          },
          {
            "id": "IN-MAL-2026-021421",
            "sha256": "44dd37ed96611f26302ed323de01f14fba9077aa6798410193047ab11d7ffc81",
            "source": "amazon-inspector",
            "versions": [
              "100.100.101"
            ],
            "import_time": "2026-10-11T14:18:04.233387431Z",
            "modified_time": "2026-10-11T13:56:54Z"
          }
        ]
      }
    },
    "related_cves": [],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "core-osv",
  "document_id": 286047,
  "published_at": "2026-10-11T13:56:54+00:00"
}