Malicious code in kmf-bootstrap (npm)

{
  "id": "71ad2b8bb582e2df3b1732a24af809d1164b409705afda9900d1b833597adca9",
  "url": "https://osv.dev/vulnerability/MAL-2026-17746",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Malicious code in kmf-bootstrap (npm)",
    "summary": "--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (b95cb55a24f11248b1635861f0a10a3cb41bc4ee6ac7e2100439ca7c947bba74) On npm install, the package's postinstall script performs two exfiltration actions. First, it reads the installer's hostname and npm_package_name and issues DNS resolutions for a label of the form ..db4jlbku53082dmp0d7g3mffj7s7aordk.oast.me, leaking those identifiers to an Interactsh (oast.me) collaborator over DNS. Second, postinstall.js require()s a shipped Linux x64 native addon at prebuilds/linux-x64/addon.node that calls gethostname() and getpwuid()->pw_name and reads the npm_package_name and npm_config_registry environment variables, then opens a raw socket and sends an HTTP POST with body h=&u=&p=&r= to the bare IP 64.181.165.115 (Host header 64.181.165.115, path /dc, HTTP/1.0, no TLS). The destination is a bare IP with no relation to the package publisher and the npm_config_registry value can disclose a private/internal registry URL from the installer's.npmrc. The native component is opaque code auto-executed during install with host-level network egress. The package name resembles the common 'bootstrap' naming convention, consistent with a dependency-confusion / typosquat lure whose purpose is to beacon successful installs and private registry metadata. ## Source: ossf-package-analysis (4a4e085f9bdddf6800e613b7cdfeb6b2481b2fe9bf0ccb2a5b1bffad9538194b) The OpenSSF Package Analysis project identified 'kmf-bootstrap' ",
    "evidence": "osv:MAL-2026-17746",
    "products": [
      {
        "name": {
          "value": "kmf-bootstrap",
          "evidence": "/affected/0/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": [
          {
            "value": "100.100.102",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "100.100.103",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "100.100.106",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "100.100.101",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "100.100.100",
            "evidence": "/affected/0/versions"
          }
        ]
      }
    ],
    "severity": "unknown",
    "structured": {
      "id": "MAL-2026-17746",
      "aliases": [
        "MAL-2026-17746"
      ],
      "affected": [
        {
          "package": {
            "name": "kmf-bootstrap",
            "purl": "pkg:npm/kmf-bootstrap",
            "ecosystem": "npm"
          },
          "versions": [
            "100.100.102",
            "100.100.103",
            "100.100.106",
            "100.100.101",
            "100.100.100"
          ],
          "database_specific": {
            "cwes": [
              {
                "name": "Embedded Malicious Code",
                "cweId": "CWE-506",
                "description": "The product contains code that appears to be malicious in nature."
              },
              {
                "name": "Embedded Malicious Code",
                "cweId": "CWE-506",
                "description": "The product contains code that appears to be malicious in nature."
              },
              {
                "name": "Embedded Malicious Code",
                "cweId": "CWE-506",
                "description": "The product contains code that appears to be malicious in nature."
              },
              {
                "name": "Embedded Malicious Code",
                "cweId": "CWE-506",
                "description": "The product contains code that appears to be malicious in nature."
              },
              {
                "name": "Embedded Malicious Code",
                "cweId": "CWE-506",
                "description": "The product contains code that appears to be malicious in nature."
              }
            ],
            "source": "https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/kmf-bootstrap/MAL-2026-17746.json",
            "indicators": {
              "evidence_files": [
                {
                  "path": "index.js",
                  "tlsh": "97f0e5aa4a7055a01a97120dd33f680aa8e7f1276c8a95407e9d66910f7061222511f8",
                  "sha256": "ad83f21106b39d76f42ab4914cf4f2c718774afbc56db120903cfc774cba9c43"
                }
              ],
              "package_integrity": [
                {
                  "hashes": {
                    "sha1": "c33c469662a02914b6e599eff5771311d5aafbd3",
                    "sha512_sri": "sha512-2rRl/0EjP1UAqNE8YO1cyEogeuJibH1LNXtNdZzXy/8yp2KSVbrABL2soJgWoM6mSp6t6QKpI2/Ew/dcJLTHjg=="
                  },
                  "filename": "kmf-bootstrap-100.100.106.tgz"
                }
              ]
            }
          }
        }
      ],
      "modified": "2026-10-11T14:30:09.336331761Z",
      "provider": "osv",
      "references": [
        "https://www.npmjs.com/package/kmf-bootstrap/v/100.100.106",
        "https://www.npmjs.com/package/kmf-bootstrap/v/100.100.101",
        "https://www.npmjs.com/package/kmf-bootstrap/v/100.100.103",
        "https://www.npmjs.com/package/kmf-bootstrap/v/100.100.102",
        "https://www.npmjs.com/package/kmf-bootstrap/v/100.100.100"
      ],
      "provider_metadata": {
        "malicious-packages-origins": [
          {
            "sha256": "4a4e085f9bdddf6800e613b7cdfeb6b2481b2fe9bf0ccb2a5b1bffad9538194b",
            "source": "ossf-package-analysis",
            "versions": [
              "100.100.102"
            ],
            "import_time": "2026-10-09T19:15:19.265428863Z",
            "modified_time": "2026-10-09T19:10:34Z"
          },
          {
            "sha256": "cc9f15e56fb0bf13a7c0bb8ebfa0eeeaa376629272d6fed9073b9c338e1c6862",
            "source": "ossf-package-analysis",
            "versions": [
              "100.100.103"
            ],
            "import_time": "2026-10-09T19:41:44.128123577Z",
            "modified_time": "2026-10-09T19:25:54Z"
          },
          {
            "id": "IN-MAL-2026-021398",
            "sha256": "2405275a8f22c4e8d737c5bb93149a073ddecb6a6daf67715cb4bc2218f76161",
            "source": "amazon-inspector",
            "versions": [
              "100.100.106"
            ],
            "import_time": "2026-10-11T14:18:02.341341906Z",
            "modified_time": "2026-10-11T13:53:23Z"
          },
          {
            "id": "IN-MAL-2026-021385",
            "sha256": "746ee8923cc246b2816dd79a756552ce7975ae9305f195b502f9225a348e00ec",
            "source": "amazon-inspector",
            "versions": [
              "100.100.101"
            ],
            "import_time": "2026-10-11T14:18:01.319831262Z",
            "modified_time": "2026-10-11T13:51:32Z"
          },
          {
            "id": "IN-MAL-2026-021388",
            "sha256": "956976b01563579f32919e883c10229d2cf459fa2253ca34bd164fe83016a567",
            "source": "amazon-inspector",
            "versions": [
              "100.100.103"
            ],
            "import_time": "2026-10-11T14:18:01.54674888Z",
            "modified_time": "2026-10-11T13:51:57Z"
          },
          {
            "id": "IN-MAL-2026-021413",
            "sha256": "b95cb55a24f11248b1635861f0a10a3cb41bc4ee6ac7e2100439ca7c947bba74",
            "source": "amazon-inspector",
            "versions": [
              "100.100.102"
            ],
            "import_time": "2026-10-11T14:18:03.53680973Z",
            "modified_time": "2026-10-11T13:55:39Z"
          },
          {
            "id": "IN-MAL-2026-021426",
            "sha256": "dbbe7e819b6a360576d8c7ea55ef5da42e2bbb24596548235569fa9f8df6d646",
            "source": "amazon-inspector",
            "versions": [
              "100.100.100"
            ],
            "import_time": "2026-10-11T14:18:04.609307912Z",
            "modified_time": "2026-10-11T13:57:41Z"
          }
        ]
      }
    },
    "related_cves": [],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "core-osv",
  "document_id": 286053,
  "published_at": "2026-10-09T19:10:34+00:00"
}