Malicious code in test-account-portal-fe (npm)

{
  "id": "4c9e9c2fba02bc0e1b9e97aa38ea50429cf51a0253d2b13144921b056c86a70a",
  "url": "https://osv.dev/vulnerability/MAL-2026-17748",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Malicious code in test-account-portal-fe (npm)",
    "summary": "--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (0f7b6c3f1f6f212d75283827455926079593132bbd819dec884caed3e3b745ca) npm package test-account-portal-fe@100.100.101 ships only a Linux x64 native addon at prebuilds/linux-x64/addon.node and loads it unconditionally from index.js via require('./prebuilds/linux-x64/addon'). No C/C++ source, binding.gyp, prebuild URL, or checksum accompanies the binary, and the stated purpose (\"Frontend utilities\") has no need for a native addon. On NAPI module init the addon forks and opens a socket to the hardcoded bare IP 64.181.165.115, issuing POST /dc HTTP/1.0 with a body of the form h=&u=&p=&r=, exfiltrating the installer's host identity, local username, consuming package name, and configured npm registry URL. ELF strings and imports (socket/connect/send/gethostname/getpwuid/getenv, symbol try_connect) corroborate the beacon. The package name and implausibly high version (100.100.101) alongside a placeholder description are consistent with a dependency-confusion probe against an internal account-portal-fe package: exfiltrating npm_config_registry is precisely how such a probe confirms resolution against a private registry. Installing or requiring this package automatically leaks installer identity and internal registry configuration to attacker-controlled infrastructure. ## Source: ossf-package-analysis (5dd02103458df4faa2c37da43a76a468a0a22d591fb77c5d756e7d7496d68907) The OpenSSF Package Analysis projec",
    "evidence": "osv:MAL-2026-17748",
    "products": [
      {
        "name": {
          "value": "test-account-portal-fe",
          "evidence": "/affected/0/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": [
          {
            "value": "100.100.102",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "100.100.100",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "100.100.101",
            "evidence": "/affected/0/versions"
          }
        ]
      }
    ],
    "severity": "unknown",
    "structured": {
      "id": "MAL-2026-17748",
      "aliases": [
        "MAL-2026-17748"
      ],
      "affected": [
        {
          "package": {
            "name": "test-account-portal-fe",
            "purl": "pkg:npm/test-account-portal-fe",
            "ecosystem": "npm"
          },
          "versions": [
            "100.100.102",
            "100.100.100",
            "100.100.101"
          ],
          "database_specific": {
            "cwes": [
              {
                "name": "Embedded Malicious Code",
                "cweId": "CWE-506",
                "description": "The product contains code that appears to be malicious in nature."
              },
              {
                "name": "Embedded Malicious Code",
                "cweId": "CWE-506",
                "description": "The product contains code that appears to be malicious in nature."
              },
              {
                "name": "Embedded Malicious Code",
                "cweId": "CWE-506",
                "description": "The product contains code that appears to be malicious in nature."
              }
            ],
            "source": "https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/test-account-portal-fe/MAL-2026-17748.json",
            "indicators": {
              "evidence_files": [
                {
                  "path": "prebuilds/linux-x64/addon.node",
                  "tlsh": "c272761bb761c93bc4e853389497466572f2a470777243232f00a17a2cd37889ebbd5a",
                  "sha256": "d1ecb9d24c13b9a47b3fc19036fee676e13c65af1df61b8d61bd9ec8aadeb906"
                },
                {
                  "path": "package.json",
                  "tlsh": "b2d012140e33963378c04ba55d275a0e65720d6f4004b41c13e3215982dabfb4cbb31e",
                  "sha256": "86fc6110d043ca50d2fee85029e57fb3e90d6d4d34388d0c53e5a621ece55f01"
                }
              ],
              "package_integrity": [
                {
                  "hashes": {
                    "sha1": "0841039ad4b8e151fec618983a25fd7758e59af1",
                    "sha512_sri": "sha512-Mml9T4BaC/IR7y0V675pQLyh70mkuEiDSCjeHtDNZmMP/eNTFYzf9AyW+/VUaFwTPhOA+w/d1h4vcjUyQP2ijA=="
                  },
                  "filename": "test-account-portal-fe-100.100.100.tgz"
                }
              ]
            }
          }
        }
      ],
      "modified": "2026-10-13T07:45:14.807751361Z",
      "provider": "osv",
      "references": [
        "https://www.npmjs.com/package/test-account-portal-fe/v/100.100.100",
        "https://www.npmjs.com/package/test-account-portal-fe/v/100.100.102",
        "https://www.npmjs.com/package/test-account-portal-fe/v/100.100.101"
      ],
      "provider_metadata": {
        "malicious-packages-origins": [
          {
            "sha256": "5dd02103458df4faa2c37da43a76a468a0a22d591fb77c5d756e7d7496d68907",
            "source": "ossf-package-analysis",
            "versions": [
              "100.100.102"
            ],
            "import_time": "2026-10-09T19:15:19.362264369Z",
            "modified_time": "2026-10-09T19:10:36Z"
          },
          {
            "id": "IN-MAL-2026-021423",
            "sha256": "63911c5f393d2276fffe11b7d465b04704722dc852a79fbfbd63b5f8dbd812b8",
            "source": "amazon-inspector",
            "versions": [
              "100.100.100"
            ],
            "import_time": "2026-10-11T14:18:04.381155092Z",
            "modified_time": "2026-10-11T13:57:11Z"
          },
          {
            "id": "IN-MAL-2026-021378",
            "sha256": "d9191f0c04c63fc8aa02af2a97681b15cfd241ead915ee30f0b79baa0c4e0200",
            "source": "amazon-inspector",
            "versions": [
              "100.100.102"
            ],
            "import_time": "2026-10-11T14:18:00.739376595Z",
            "modified_time": "2026-10-11T13:50:23Z"
          },
          {
            "id": "IN-MAL-2026-021469",
            "sha256": "0f7b6c3f1f6f212d75283827455926079593132bbd819dec884caed3e3b745ca",
            "source": "amazon-inspector",
            "versions": [
              "100.100.101"
            ],
            "import_time": "2026-10-13T07:32:01.72436852Z",
            "modified_time": "2026-10-13T07:08:59Z"
          }
        ]
      }
    },
    "related_cves": [],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "core-osv",
  "document_id": 307461,
  "published_at": "2026-10-09T19:10:36+00:00"
}