{"id":"MAL-2026-17572","revision":"145ade56fb424268ac5f9cca5332aa40","records":[{"revision":"145ade56fb424268ac5f9cca5332aa40","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"MAL-2026-17572","aliases":[],"title":"Malicious code in checkmate-remediation-assistant (npm)","description":"checkmate-remediation-assistant@1.0.0 contains no functional code: its only behaviour is a preinstall script that runs `node index.js` on npm install. index.js collects the install directory, the user's home directory, hostname, username and DNS servers, and the full contents of /etc/passwd and /etc/hosts, then sends them as JSON in an HTTPS POST to `9q0lp9mr6ek7nrnklhzkmbpuglmda4yt.oastify.com`, a Burp Collaborator endpoint. The npm account testneo7755 published it on 2026-10-05 and it was unpublished about two minutes later; the same account published with-cte the same day with the same index.js and a different Collaborator subdomain.\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (c8f55d0ebeea19e228ec6edbb1782df87539c476478d3935559fda90a458b1b4)\nThe package's package.json declares a preinstall hook that runs index.js on npm install. index.js collects os.hostname(), os.userInfo(), the home directory, DNS server configuration, __dirname, the local package.json, and the contents of /etc/passwd and /etc/hosts, then transmits the collected data over HTTPS to a hardcoded Burp Collaborator (oastify.com) subdomain (9q0lp9mr6ek7nrnklhzkmbpuglmda4yt.oastify.com). The destination is an out-of-band interaction server not associated with any declared publisher or documented package purpose, and the exfiltration fires automatically on default install without user interaction.\n","state":0,"publishedAt":"2026-10-05T09:02:39+00:00","modifiedAt":"2026-10-07T06:30:05.4433634+00:00","affected":[{"ecosystem":"npm","name":"checkmate-remediation-assistant","ranges":[],"versions":["1.0.0"],"rawVersionEvidence":null}],"metrics":[],"references":["https://www.npmjs.com/package/checkmate-remediation-assistant/v/1.0.0","https://www.npmjs.com/package/checkmate-remediation-assistant"],"sourceUrl":"https://osv.dev/vulnerability/MAL-2026-17572","license":"OSV · upstream source license applies","key":"osv:MAL-2026-17572","identifiers":["MAL-2026-17572"]},"retained":false,"historicalAffected":[]}],"coverage":[]}