Skip to content
Heist/ feed
Back to feed
Unrated

Malicious code in @myorder-frontend-commons/analytics (npm)

Type: advisorySources: OSV

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (4e5f7ea46a15cf0b816818dfef340f91e8e4b3b8ac149af84cf133282a90202e) Package is published to the public npm scope @myorder-frontend-commons and declares preinstall, install, and postinstall lifecycle scripts all set to `node poc.js`, so the payload auto-executes on any `npm install` that resolves this scope. poc.js collects host identifiers (os.hostname(), os.userInfo().username, os.platform()/arch/release, process.cwd(), node version, package metadata, and names of CI-related environment variables) and transmits them via HTTP GET to a hardcoded Interactsh out-of-band subdomain at db4jftohu4noreqdanngpnb3ger45ykrt.oast.fun and a hardcoded IP-based backup collector at 80-190-83-27.nip.io, plus a hex-encoded DNS-label beacon containing the hostname, user, and version. index.js exports stubs that mirror the API shape of an internal package of the same name, which is the dependency-confusion lure: an internal build system that mistakenly resolves against the public registry will install this package and immediately execute the beacon. The payload satisfies the installer-harm gate (install-time code execution plus host-identifier exfiltration to third-party collectors) regardless of any "authorized PoC" framing, because the installer did not consent and the destinations are not controlled by the installer. ## Source: ghsa-malware (cbade25b03a760b27caec2096e5167b8742e35bf836a879acfb5c1fb04b9db17)

Products
@myorder-frontend-commons/analytics
Affected versions
0.0.0-stage, 0.0.1, 0.1.0, 0.2.0, 1.0.0, 1.1.0, 1.2.0, 10.0.0, 100.0.0, 101.0.0, 2.0.0, 3.0.0, 5.0.0, 99.0.0
Fixed versions
Not specified
CVEs
Not specified
Confirmed fixed CVEs
Not specified
Updated in this feed
30 Oct 2026, 11:12 UTC · Revision 1

Source evidence

Malicious code in @myorder-frontend-commons/analytics (npm)

core-osv · Original source

Published 9 Oct 2026, 19:31 UTC

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (4e5f7ea46a15cf0b816818dfef340f91e8e4b3b8ac149af84cf133282a90202e) Package is published to the public npm scope @myorder-frontend-commons and declares preinstall, install, and postinstall lifecycle scripts all set to `node poc.js`, so the payload auto-executes on any `npm install` that resolves this scope. poc.js collects host identifiers (os.hostname(), os.userInfo().username, os.platform()/arch/release, process.cwd(), node version, package metadata, and names of CI-related environment variables) and transmits them via HTTP GET to a hardcoded Interactsh out-of-band subdomain at db4jftohu4noreqdanngpnb3ger45ykrt.oast.fun and a hardcoded IP-based backup collector at 80-190-83-27.nip.io, plus a hex-encoded DNS-label beacon containing the hostname, user, and version. index.js exports stubs that mirror the API shape of an internal package of the same name, which is the dependency-confusion lure: an internal build system that mistakenly resolves against the public registry will install this package and immediately execute the beacon. The payload satisfies the installer-harm gate (install-time code execution plus host-identifier exfiltration to third-party collectors) regardless of any "authorized PoC" framing, because the installer did not consent and the destinations are not controlled by the installer. ## Source: ghsa-malware (cbade25b03a760b27caec2096e5167b8742e35bf836a879acfb5c1fb04b9db17)

osv:MAL-2026-17749

@myorder-frontend-commons/analytics

Fixed versions: Not specified

Complete source record
{
  "id": "1258e8a08449490aeddd2bc5cec7b5a8a90a81c3eff3a3396547a90f27a910e9",
  "url": "https://osv.dev/vulnerability/MAL-2026-17749",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Malicious code in @myorder-frontend-commons/analytics (npm)",
    "summary": "--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (4e5f7ea46a15cf0b816818dfef340f91e8e4b3b8ac149af84cf133282a90202e) Package is published to the public npm scope @myorder-frontend-commons and declares preinstall, install, and postinstall lifecycle scripts all set to `node poc.js`, so the payload auto-executes on any `npm install` that resolves this scope. poc.js collects host identifiers (os.hostname(), os.userInfo().username, os.platform()/arch/release, process.cwd(), node version, package metadata, and names of CI-related environment variables) and transmits them via HTTP GET to a hardcoded Interactsh out-of-band subdomain at db4jftohu4noreqdanngpnb3ger45ykrt.oast.fun and a hardcoded IP-based backup collector at 80-190-83-27.nip.io, plus a hex-encoded DNS-label beacon containing the hostname, user, and version. index.js exports stubs that mirror the API shape of an internal package of the same name, which is the dependency-confusion lure: an internal build system that mistakenly resolves against the public registry will install this package and immediately execute the beacon. The payload satisfies the installer-harm gate (install-time code execution plus host-identifier exfiltration to third-party collectors) regardless of any \"authorized PoC\" framing, because the installer did not consent and the destinations are not controlled by the installer. ## Source: ghsa-malware (cbade25b03a760b27caec2096e5167b8742e35bf836a879acfb5c1fb04b9db17) ",
    "evidence": "osv:MAL-2026-17749",
    "products": [
      {
        "name": {
          "value": "@myorder-frontend-commons/analytics",
          "evidence": "/affected/0/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": [
          {
            "value": "99.0.0",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "10.0.0",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "3.0.0",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "1.0.0",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "1.2.0",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "0.0.1",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "2.0.0",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "0.1.0",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "5.0.0",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "0.2.0",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "1.1.0",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "100.0.0",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "101.0.0",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "0.0.0-stage",
            "evidence": "/affected/0/versions"
          }
        ]
      }
    ],
    "severity": "unknown",
    "structured": {
      "id": "MAL-2026-17749",
      "aliases": [
        "GHSA-4xrc-8qvp-c7r5",
        "MAL-2026-17749"
      ],
      "affected": [
        {
          "package": {
            "name": "@myorder-frontend-commons/analytics",
            "purl": "pkg:npm/%40myorder-frontend-commons/analytics",
            "ecosystem": "npm"
          },
          "versions": [
            "99.0.0",
            "10.0.0",
            "3.0.0",
            "1.0.0",
            "1.2.0",
            "0.0.1",
            "2.0.0",
            "0.1.0",
            "5.0.0",
            "0.2.0",
            "1.1.0",
            "100.0.0",
            "101.0.0",
            "0.0.0-stage"
          ],
          "database_specific": {
            "cwes": [
              {
                "name": "Embedded Malicious Code",
                "cweId": "CWE-506",
                "description": "The product contains code that appears to be malicious in nature."
              },
              {
                "name": "Embedded Malicious Code",
                "cweId": "CWE-506",
                "description": "The product contains code that appears to be malicious in nature."
              },
              {
                "name": "Embedded Malicious Code",
                "cweId": "CWE-506",
                "description": "The product contains code that appears to be malicious in nature."
              },
              {
                "name": "Embedded Malicious Code",
                "cweId": "CWE-506",
                "description": "The product contains code that appears to be malicious in nature."
              },
              {
                "name": "Embedded Malicious Code",
                "cweId": "CWE-506",
                "description": "The product contains code that appears to be malicious in nature."
              },
              {
                "name": "Embedded Malicious Code",
                "cweId": "CWE-506",
                "description": "The product contains code that appears to be malicious in nature."
              },
              {
                "name": "Embedded Malicious Code",
                "cweId": "CWE-506",
                "description": "The product contains code that appears to be malicious in nature."
              },
              {
                "name": "Embedded Malicious Code",
                "cweId": "CWE-506",
                "description": "The product contains code that appears to be malicious in nature."
              },
              {
                "name": "Embedded Malicious Code",
                "cweId": "CWE-506",
                "description": "The product contains code that appears to be malicious in nature."
              },
              {
                "name": "Embedded Malicious Code",
                "cweId": "CWE-506",
                "description": "The product contains code that appears to be malicious in nature."
              },
              {
                "name": "Embedded Malicious Code",
                "cweId": "CWE-506",
                "description": "The product contains code that appears to be malicious in nature."
              },
              {
                "name": "Embedded Malicious Code",
                "cweId": "CWE-506",
                "description": "The product contains code that appears to be malicious in nature."
              },
              {
                "name": "Embedded Malicious Code",
                "cweId": "CWE-506",
                "description": "The product contains code that appears to be malicious in nature."
              },
              {
                "name": "Embedded Malicious Code",
                "cweId": "CWE-506",
                "description": "The product contains code that appears to be malicious in nature."
              },
              {
                "name": "Embedded Malicious Code",
                "cweId": "CWE-506",
                "description": "The product contains code that appears to be malicious in nature."
              }
            ],
            "source": "https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@myorder-frontend-commons/analytics/MAL-2026-17749.json",
            "indicators": {
              "evidence_files": [
                {
                  "path": "poc.js",
                  "tlsh": "8571f949a1b6623421ea76b412af409ca3bfe25a002ac794b85ed2581f8587c0233dfd",
                  "sha256": "19eebd91a1065fc4b2528899dec153eae22788d696fe3147fb1be614420e2e16"
                },
                {
                  "path": "README.md",
                  "tlsh": "a531d6a3d995623502e986fd0ca6b2e99b37833a050106c4b88e53c55bc6d8c077b075",
                  "sha256": "a7f1ab450601dfce324752f369b01c0a5327bce511c5df59d74776ca732a7d47"
                }
              ],
              "package_integrity": [
                {
                  "hashes": {
                    "sha1": "123c92a6e28c5b30bafc8ef0195eb8b03ddab20b",
                    "sha512_sri": "sha512-c1MIIcGMsnQTZc1qr6ZwMn+ar/5kNAC245EeJ1tu+Xq/FiX1gRI8F0j25tQCJC5xzClt1dK+Ag1Ya+++hD/jcQ=="
                  },
                  "filename": "analytics-1.0.0.tgz"
                }
              ]
            }
          }
        }
      ],
      "modified": "2026-10-13T23:00:04.836664672Z",
      "provider": "osv",
      "references": [
        "https://www.npmjs.com/package/@myorder-frontend-commons/analytics/v/1.0.0",
        "https://www.npmjs.com/package/@myorder-frontend-commons/analytics/v/1.2.0",
        "https://www.npmjs.com/package/@myorder-frontend-commons/analytics/v/0.0.1",
        "https://www.npmjs.com/package/@myorder-frontend-commons/analytics/v/2.0.0",
        "https://www.npmjs.com/package/@myorder-frontend-commons/analytics/v/0.1.0",
        "https://www.npmjs.com/package/@myorder-frontend-commons/analytics/v/5.0.0",
        "https://www.npmjs.com/package/@myorder-frontend-commons/analytics/v/0.2.0",
        "https://www.npmjs.com/package/@myorder-frontend-commons/analytics/v/10.0.0",
        "https://www.npmjs.com/package/@myorder-frontend-commons/analytics/v/1.1.0",
        "https://www.npmjs.com/package/@myorder-frontend-commons/analytics/v/100.0.0",
        "https://www.npmjs.com/package/@myorder-frontend-commons/analytics/v/3.0.0",
        "https://www.npmjs.com/package/@myorder-frontend-commons/analytics/v/99.0.0",
        "https://www.npmjs.com/package/@myorder-frontend-commons/analytics/v/101.0.0",
        "https://github.com/advisories/GHSA-4xrc-8qvp-c7r5",
        "https://www.npmjs.com/package/@myorder-frontend-commons/analytics",
        "https://osv.dev/vulnerability/MAL-2026-17749"
      ],
      "provider_metadata": {
        "iocs": {
          "urls": [
            "http://80-190-83-27.nip.io/beacon/594c7180-55fb-48e0-9aa5-32c1278fed3e"
          ],
          "files": [
            {
              "note": "Declares preinstall, install and postinstall scripts that each run `node poc.js`.",
              "paths": [
                "package.json"
              ],
              "source": "PACKAGE_ARCHIVE",
              "digests": {
                "sha256": "1f67d8f6dc4d4eb23bea09578178ed020d58739976a4fa43c121ebbc0a3b9b35"
              }
            },
            {
              "note": "Executed by the preinstall script of @myorder-frontend-commons/analytics@101.0.0.",
              "paths": [
                "poc.js"
              ],
              "source": "PACKAGE_ARCHIVE",
              "digests": {
                "sha256": "ce8ceac931f2f7dc41a7547ca72c8667ebb0539fcecb8de0b4ccc2fe14da6d6c"
              }
            },
            {
              "note": "Executed by the install script of @myorder-frontend-commons/analytics@101.0.0.",
              "paths": [
                "poc.js"
              ],
              "source": "PACKAGE_ARCHIVE",
              "digests": {
                "sha256": "ce8ceac931f2f7dc41a7547ca72c8667ebb0539fcecb8de0b4ccc2fe14da6d6c"
              }
            },
            {
              "note": "Executed by the postinstall script of @myorder-frontend-commons/analytics@101.0.0.",
              "paths": [
                "poc.js"
              ],
              "source": "PACKAGE_ARCHIVE",
              "digests": {
                "sha256": "ce8ceac931f2f7dc41a7547ca72c8667ebb0539fcecb8de0b4ccc2fe14da6d6c"
              }
            }
          ],
          "domains": [
            "db69ak0hu4nqhtf9omnguspxhjk8kuide.oast.fun",
            "db4jftohu4noreqdanngpnb3ger45ykrt.oast.fun"
          ]
        },
        "malicious-packages-origins": [
          {
            "sha256": "43a2fe0052005fedc0434fc354ae8777e198113f2371fddfbc9d79ffdd87fbb5",
            "source": "ossf-package-analysis",
            "versions": [
              "99.0.0"
            ],
            "import_time": "2026-10-09T19:41:44.318327446Z",
            "modified_time": "2026-10-09T19:31:38Z"
          },
          {
            "sha256": "cc131ca9c1a40353c2c2aa2aba352d0e3ff2df099b3795302a2fcdfdc464f87d",
            "source": "ossf-package-analysis",
            "versions": [
              "10.0.0"
            ],
            "import_time": "2026-10-09T19:41:44.450120231Z",
            "modified_time": "2026-10-09T19:34:25Z"
          },
          {
            "sha256": "062ddd2c612969136a72471502408ce533f8050ce6239517c3d95cccb4e7d0aa",
            "source": "ossf-package-analysis",
            "versions": [
              "3.0.0"
            ],
            "import_time": "2026-10-09T20:19:31.305790105Z",
            "modified_time": "2026-10-09T19:56:04Z"
          },
          {
            "id": "IN-MAL-2026-021394",
            "sha256": "e96682a1062156b90af13a4aafd1df032e48b355c0f8ca14bba2b12338f5045d",
            "source": "amazon-inspector",
            "versions": [
              "1.0.0"
            ],
            "import_time": "2026-10-11T14:18:02.012469135Z",
            "modified_time": "2026-10-11T13:52:52Z"
          },
          {
            "id": "IN-MAL-2026-021390",
            "sha256": "05b6a7de980cb46cfe69dd4738d6e319f2b495186e1c40a66f2bd53f5f30ae36",
            "source": "amazon-inspector",
            "versions": [
              "1.2.0"
            ],
            "import_time": "2026-10-11T14:18:01.718505554Z",
            "modified_time": "2026-10-11T13:52:16Z"
          },
          {
            "id": "IN-MAL-2026-021391",
            "sha256": "13cbd086045754e282958eb931be284d815e0da304a3f179e600144ab67469c5",
            "source": "amazon-inspector",
            "versions": [
              "0.0.1"
            ],
            "import_time": "2026-10-11T14:18:01.789394267Z",
            "modified_time": "2026-10-11T13:52:25Z"
          },
          {
            "id": "IN-MAL-2026-021392",
            "sha256": "4e5f7ea46a15cf0b816818dfef340f91e8e4b3b8ac149af84cf133282a90202e",
            "source": "amazon-inspector",
            "versions": [
              "2.0.0"
            ],
            "import_time": "2026-10-11T14:18:01.858992722Z",
            "modified_time": "2026-10-11T13:52:34Z"
          },
          {
            "id": "IN-MAL-2026-021444",
            "sha256": "b4241f553ce04126fcf00fa2342e3d48f5776215181d50ce0e85f3ec9072607e",
            "source": "amazon-inspector",
            "versions": [
              "0.1.0"
            ],
            "import_time": "2026-10-11T14:18:06.585241369Z",
            "modified_time": "2026-10-11T14:00:47Z"
          },
          {
            "id": "IN-MAL-2026-021395",
            "sha256": "c16eab7e4d2a6d259e01b0a9a8e7e9643e58ae2d97a8bc37e741cce9a617984f",
            "source": "amazon-inspector",
            "versions": [
              "5.0.0"
            ],
            "import_time": "2026-10-11T14:18:02.090589617Z",
            "modified_time": "2026-10-11T13:52:59Z"
          },
          {
            "id": "IN-MAL-2026-021393",
            "sha256": "d041bc9f70a639da387bcbae780995069d6039425c549439562dc941a618a7e6",
            "source": "amazon-inspector",
            "versions": [
              "0.2.0"
            ],
            "import_time": "2026-10-11T14:18:01.93147482Z",
            "modified_time": "2026-10-11T13:52:41Z"
          },
          {
            "id": "IN-MAL-2026-021441",
            "sha256": "dd46fe52e55ff3f8ffb6e1483368f3eb41b7d3b5004227cb170fdcd4286fa88a",
            "source": "amazon-inspector",
            "versions": [
              "10.0.0"
            ],
            "import_time": "2026-10-11T14:18:06.270621087Z",
            "modified_time": "2026-10-11T14:00:17Z"
          },
          {
            "id": "IN-MAL-2026-021442",
            "sha256": "724f49c08951c3b5fa907e3f06eed47c78c37ad2c85c71f14f639fc6eff11e7d",
            "source": "amazon-inspector",
            "versions": [
              "1.1.0"
            ],
            "import_time": "2026-10-11T14:18:06.370464963Z",
            "modified_time": "2026-10-11T14:00:26Z"
          },
          {
            "id": "IN-MAL-2026-021397",
            "sha256": "b05fab58812749a39b572caf88815171b1881891bc53219e5e3cad3fa47c4557",
            "source": "amazon-inspector",
            "versions": [
              "100.0.0"
            ],
            "import_time": "2026-10-11T14:18:02.271383373Z",
            "modified_time": "2026-10-11T13:53:14Z"
          },
          {
            "id": "IN-MAL-2026-021458",
            "sha256": "3229aecde56d5b2b166ffdf18b381c7d2150df9eee86450e19e491838c90fe6d",
            "source": "amazon-inspector",
            "versions": [
              "3.0.0"
            ],
            "import_time": "2026-10-11T17:15:52.401241744Z",
            "modified_time": "2026-10-11T16:56:29Z"
          },
          {
            "id": "IN-MAL-2026-021450",
            "sha256": "565117916484d64d3217831536768e8368b66dfd26c5d2ee917f2925a1fb88cd",
            "source": "amazon-inspector",
            "versions": [
              "99.0.0"
            ],
            "import_time": "2026-10-11T17:15:51.731146612Z",
            "modified_time": "2026-10-11T16:53:32Z"
          },
          {
            "id": "IN-MAL-2026-021463",
            "sha256": "b49bc3491a129cad79586aed0d6e5cac39dc0fa907ac3560b6ddaba7dc8cf675",
            "source": "amazon-inspector",
            "versions": [
              "101.0.0"
            ],
            "import_time": "2026-10-12T14:26:36.231407531Z",
            "modified_time": "2026-10-12T14:24:11Z"
          },
          {
            "id": "GHSA-4xrc-8qvp-c7r5",
            "sha256": "cbade25b03a760b27caec2096e5167b8742e35bf836a879acfb5c1fb04b9db17",
            "source": "ghsa-malware",
            "versions": [
              "101.0.0",
              "100.0.0",
              "10.0.0",
              "3.0.0",
              "1.0.0",
              "1.1.0",
              "5.0.0",
              "0.2.0",
              "2.0.0",
              "1.2.0",
              "0.1.0",
              "0.0.1",
              "99.0.0",
              "0.0.0-stage"
            ],
            "import_time": "2026-10-12T19:24:46.895721152Z",
            "modified_time": "2026-10-12T18:54:08Z"
          }
        ]
      }
    },
    "related_cves": [],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "core-osv",
  "document_id": 313737,
  "published_at": "2026-10-09T19:31:38+00:00"
}