Malicious code in pay-methods-kmf (npm)

{
  "id": "35d75ab923787a6d3a1928a93889fe57c26044d5a4f77b26909dd1a79f9b7f78",
  "url": "https://osv.dev/vulnerability/MAL-2026-17776",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Malicious code in pay-methods-kmf (npm)",
    "summary": "--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (07a616a1db0408a0570000c6514224d22e71c3ecee0f08268b5dd9bc96761fd2) pay-methods-kmf@100.100.102 is a trivial stub (empty index.js, manifest description 'Frontend utilities') that ships a prebuilt Linux x64 native addon at prebuilds/linux-x64/addon.node and loads it from postinstall.js via require('./prebuilds/linux-x64/addon.node'). On install the postinstall path performs two concurrent exfiltration channels: (1) a DNS beacon that resolves a subdomain of the form ..db4jlbku53082dmp0d7g3mffj7s7aordk.oast.me against an interactsh/OAST collector, encoding the installer hostname and package name into the DNS label; and (2) the native addon calls gethostname, getpwuid, and getenv and issues an HTTP POST to the hardcoded bare IPv4 endpoint http://64.181.165.115/dc with body shape 'h=&u=&p=&r=', leaking the installer's hostname, username, package name, and configured npm registry URL (which may reveal internal/private registry hosts). The package ships no source for the binary, the compiled addon's symbol set (socket/connect/send/fork) is unrelated to any frontend utility, and both the OAST subdomain and the bare-IP POST endpoint are attacker-controlled infrastructure. Dependency-confusion-style version (100.100.102) and the registry-URL field in the exfil payload are consistent with internal-registry reconnaissance.",
    "evidence": "osv:MAL-2026-17776",
    "products": [
      {
        "name": {
          "value": "pay-methods-kmf",
          "evidence": "/affected/0/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": [
          {
            "value": "100.100.102",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "100.100.100",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "100.100.101",
            "evidence": "/affected/0/versions"
          }
        ]
      }
    ],
    "severity": "unknown",
    "structured": {
      "id": "MAL-2026-17776",
      "aliases": [
        "MAL-2026-17776"
      ],
      "affected": [
        {
          "package": {
            "name": "pay-methods-kmf",
            "purl": "pkg:npm/pay-methods-kmf",
            "ecosystem": "npm"
          },
          "versions": [
            "100.100.102",
            "100.100.100",
            "100.100.101"
          ],
          "database_specific": {
            "cwes": [
              {
                "name": "Embedded Malicious Code",
                "cweId": "CWE-506",
                "description": "The product contains code that appears to be malicious in nature."
              },
              {
                "name": "Embedded Malicious Code",
                "cweId": "CWE-506",
                "description": "The product contains code that appears to be malicious in nature."
              },
              {
                "name": "Embedded Malicious Code",
                "cweId": "CWE-506",
                "description": "The product contains code that appears to be malicious in nature."
              }
            ],
            "source": "https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/pay-methods-kmf/MAL-2026-17776.json",
            "indicators": {
              "evidence_files": [
                {
                  "path": "postinstall.js",
                  "tlsh": "c8f05c99efd1a394226335d884bf000578f3d1272d8ac1c831427ac20f712642723dd9",
                  "sha256": "c87a31c2ffd47105d39b97a9b2a13b65e811fa90c0491fd03ac8d52a53efa1f7"
                },
                {
                  "path": "prebuilds/linux-x64/addon.node",
                  "tlsh": "2972251bb361c93fc4e84334054b5a6572b6a4746b7313231f04a67e3ce27985e7aa8f",
                  "sha256": "1798796310908fa36529d480c1c8eb644195a9539cb574531b3eb3278458f1d5"
                }
              ],
              "package_integrity": [
                {
                  "hashes": {
                    "sha1": "a60e1287048b2b2acff868145247c68ddf29672a",
                    "sha512_sri": "sha512-00rDVzDRKPt7CM2JbDGvKMXzOwDPBfPqJpzbF4xdnaH9KNcmd5PCRvRaUL/pksp0fY6gVrC7zebGRqfv90vR4w=="
                  },
                  "filename": "pay-methods-kmf-100.100.102.tgz"
                }
              ]
            }
          }
        }
      ],
      "modified": "2026-10-11T14:30:09.176130658Z",
      "provider": "osv",
      "references": [
        "https://www.npmjs.com/package/pay-methods-kmf/v/100.100.102",
        "https://www.npmjs.com/package/pay-methods-kmf/v/100.100.100",
        "https://www.npmjs.com/package/pay-methods-kmf/v/100.100.101"
      ],
      "provider_metadata": {
        "malicious-packages-origins": [
          {
            "id": "IN-MAL-2026-021396",
            "sha256": "07a616a1db0408a0570000c6514224d22e71c3ecee0f08268b5dd9bc96761fd2",
            "source": "amazon-inspector",
            "versions": [
              "100.100.102"
            ],
            "import_time": "2026-10-11T14:18:02.165384269Z",
            "modified_time": "2026-10-11T13:53:06Z"
          },
          {
            "id": "IN-MAL-2026-021420",
            "sha256": "d83e40860a0d1540222f76bb58c3dfc3f12e6258aff42d6f8eff747bcdf28c5c",
            "source": "amazon-inspector",
            "versions": [
              "100.100.100"
            ],
            "import_time": "2026-10-11T14:18:04.16153773Z",
            "modified_time": "2026-10-11T13:56:46Z"
          },
          {
            "id": "IN-MAL-2026-021419",
            "sha256": "f7a8a051b1961e3062a37b8ff1a9eb05025dc475bf1a5c694df49f0c90349c70",
            "source": "amazon-inspector",
            "versions": [
              "100.100.101"
            ],
            "import_time": "2026-10-11T14:18:04.090942774Z",
            "modified_time": "2026-10-11T13:56:38Z"
          }
        ]
      }
    },
    "related_cves": [],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "core-osv",
  "document_id": 286050,
  "published_at": "2026-10-11T13:53:06+00:00"
}