Malicious code in @galicia-toolkit/spa-build-config (npm)

{
  "id": "6869b957b83757dc9aef476a489f823a3109811ef8f0f3d3871a539cd9ce6f42",
  "url": "https://osv.dev/vulnerability/MAL-2026-17690",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Malicious code in @galicia-toolkit/spa-build-config (npm)",
    "summary": "@galicia-toolkit/spa-build-config@999.0.3 and @galicia-toolkit/spa-build-config@999.0.5 claim the `@galicia-toolkit` scope and describe themselves as dependency-confusion PoCs. Their postinstall hook runs on npm install with `node postinstall.js || true`. The script collects package and host environment data, sends it by HTTP to `oob.s4yhii.com:9999`, and sends DNS queries to subdomains of `oob.s4yhii.com`, making it a dependency-confusion probe; it also connects to `66.94.100.203:9999`. The npm account `s4yhii_` published version 999.0.5 on 2026-10-08; 999.0.6 runs the same command on install, sends the same DNS queries, and connects to the same address. --- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (0d7fc29f59609ed2b5c7b54243b740e1daa001f3c76c4d1391edd85a528a4688) The package's postinstall script runs automatically on npm install and collects installer-side host and credential data: hostname, username, network interfaces, the full list of process.env keys, and the values of credential-grade environment variables including AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN, GITHUB_TOKEN, NPM_TOKEN, NODE_AUTH_TOKEN, ACTIONS_ID_TOKEN_REQUEST_TOKEN, ACTIONS_ID_TOKEN_REQUEST_URL, and ACTIONS_RUNTIME_TOKEN. The collected JSON blob is POSTed to oob.s4yhii.com on port 9999 at path /dep-confusion, and hostname/username are additionally beaconed via DNS subdomain lookups under *.dc.oob.s4yhii.com. The package name shape and version (",
    "evidence": "osv:MAL-2026-17690",
    "products": [
      {
        "name": {
          "value": "@galicia-toolkit/spa-build-config",
          "evidence": "/affected/0/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": [
          {
            "value": "999.0.3",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "999.0.5",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "999.0.6",
            "evidence": "/affected/0/versions"
          }
        ]
      }
    ],
    "severity": "unknown",
    "structured": {
      "id": "MAL-2026-17690",
      "aliases": [
        "GHSA-7hx2-c7qp-ggjp",
        "MAL-2026-17690"
      ],
      "affected": [
        {
          "ranges": [
            {
              "type": "SEMVER",
              "events": [
                {
                  "introduced": "0"
                }
              ]
            }
          ],
          "package": {
            "name": "@galicia-toolkit/spa-build-config",
            "purl": "pkg:npm/%40galicia-toolkit/spa-build-config",
            "ecosystem": "npm"
          },
          "versions": [
            "999.0.3",
            "999.0.5",
            "999.0.6"
          ],
          "database_specific": {
            "cwes": [
              {
                "name": "Embedded Malicious Code",
                "cweId": "CWE-506",
                "description": "The product contains code that appears to be malicious in nature."
              },
              {
                "name": "Embedded Malicious Code",
                "cweId": "CWE-506",
                "description": "The product contains code that appears to be malicious in nature."
              },
              {
                "name": "Embedded Malicious Code",
                "cweId": "CWE-506",
                "description": "The product contains code that appears to be malicious in nature."
              },
              {
                "name": "Embedded Malicious Code",
                "cweId": "CWE-506",
                "description": "The product contains code that appears to be malicious in nature."
              },
              {
                "name": "Embedded Malicious Code",
                "cweId": "CWE-506",
                "description": "The product contains code that appears to be malicious in nature."
              }
            ],
            "source": "https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@galicia-toolkit/spa-build-config/MAL-2026-17690.json",
            "indicators": {
              "evidence_files": [
                {
                  "path": "postinstall.js",
                  "tlsh": "ca11142cd360d2b889727ac4a0c44c67157bf3d137e0d2f3641e189207f71b546664ba",
                  "sha256": "14f11babedc67602e606cd4433febbb8a2b45da061a382bfa3f4bba1810e5a3e"
                }
              ],
              "package_integrity": [
                {
                  "hashes": {
                    "sha1": "d1f8398325ef5198741d32354d20bd1ef99e9aee",
                    "sha512_sri": "sha512-LeR12VlFgggSKDXf/naOh4eaOBV+hWs78W5WbNiKITs68jP/KZcS81AJcECkFXetZzLng6JbAnxsdk6c6Xlj0w=="
                  },
                  "filename": "spa-build-config-999.0.3.tgz"
                }
              ]
            }
          }
        }
      ],
      "modified": "2026-10-12T06:00:06.272438717Z",
      "provider": "osv",
      "references": [
        "https://github.com/advisories/GHSA-7hx2-c7qp-ggjp",
        "https://www.npmjs.com/package/@galicia-toolkit/spa-build-config/v/999.0.3",
        "https://www.npmjs.com/package/@galicia-toolkit/spa-build-config/v/999.0.5",
        "https://www.npmjs.com/package/@galicia-toolkit/spa-build-config/v/999.0.6",
        "https://www.npmjs.com/package/@galicia-toolkit/spa-build-config"
      ],
      "provider_metadata": {
        "iocs": {
          "ips": [
            "66.94.100.203"
          ],
          "files": [
            {
              "note": "postinstall script: node postinstall.js || true",
              "paths": [
                "package.json"
              ],
              "source": "PACKAGE_ARCHIVE",
              "digests": {
                "sha256": "63ee85220c24602baff9bd7de29541dd0a449d65f201e1ec2eb6dd49d0b40b3b"
              }
            },
            {
              "note": "Executed by the postinstall script of @galicia-toolkit/spa-build-config@999.0.3.",
              "paths": [
                "postinstall.js"
              ],
              "source": "PACKAGE_ARCHIVE",
              "digests": {
                "sha256": "14f11babedc67602e606cd4433febbb8a2b45da061a382bfa3f4bba1810e5a3e"
              }
            },
            {
              "note": "postinstall script: node postinstall.js || true",
              "paths": [
                "package.json"
              ],
              "source": "PACKAGE_ARCHIVE",
              "digests": {
                "sha256": "18c3dd276961fa62ac32b3a216aec766f00137c68b821c825b90b5c3661126a0"
              }
            },
            {
              "note": "Executed by the postinstall script of @galicia-toolkit/spa-build-config@999.0.5.",
              "paths": [
                "postinstall.js"
              ],
              "source": "PACKAGE_ARCHIVE",
              "digests": {
                "sha256": "8f594ecf273949f1dbbc8d4cd90f3133b191c05cf3162a50e934c13d48565f5f"
              }
            }
          ],
          "domains": [
            "h.dc.oob.s4yhii.com",
            "c.dc.oob.s4yhii.com",
            "m.dc.oob.s4yhii.com",
            "u.dc.oob.s4yhii.com",
            "oob.s4yhii.com"
          ]
        },
        "malicious-packages-origins": [
          {
            "id": "GHSA-7hx2-c7qp-ggjp",
            "ranges": [
              {
                "type": "SEMVER",
                "events": [
                  {
                    "introduced": "0"
                  }
                ]
              }
            ],
            "sha256": "d73838ca1c9643e89c33154a8ec8dbbf3eef2ae60cb6b2f308f4b50bb48e3395",
            "source": "ghsa-malware",
            "import_time": "2026-10-08T16:32:56.942315619Z",
            "modified_time": "2026-10-08T16:23:01Z"
          },
          {
            "id": "IN-MAL-2026-021224",
            "sha256": "57905b814cd192b53d9c34ce185c13fbcd38c3547d20acac250b76c455263fe0",
            "source": "amazon-inspector",
            "versions": [
              "999.0.3"
            ],
            "import_time": "2026-10-08T17:17:19.713489176Z",
            "modified_time": "2026-10-08T17:08:54Z"
          },
          {
            "id": "IN-MAL-2026-021223",
            "sha256": "9ae7ef5b0054a23e96199464149ff9ff3a8fbe359b22277fdc2ffc788aee806e",
            "source": "amazon-inspector",
            "versions": [
              "999.0.5"
            ],
            "import_time": "2026-10-08T17:17:19.684017692Z",
            "modified_time": "2026-10-08T17:08:44Z"
          },
          {
            "id": "IN-MAL-2026-021225",
            "sha256": "0d7fc29f59609ed2b5c7b54243b740e1daa001f3c76c4d1391edd85a528a4688",
            "source": "amazon-inspector",
            "versions": [
              "999.0.6"
            ],
            "import_time": "2026-10-08T17:17:19.744182722Z",
            "modified_time": "2026-10-08T17:09:08Z"
          }
        ]
      }
    },
    "related_cves": [],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "core-osv",
  "document_id": 298652,
  "published_at": "2026-10-08T15:19:04+00:00"
}