{"id":"MAL-2026-17579","revision":"3ce0502d06874223aa36f03f0b1c35ea","records":[{"revision":"3ce0502d06874223aa36f03f0b1c35ea","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"MAL-2026-17579","aliases":[],"title":"Malicious code in with-cte (npm)","description":"with-cte@1.0.0 contains no functional code: its only behaviour is a preinstall script that runs `node index.js` on npm install. index.js collects the install directory, the user's home directory, hostname, username and DNS servers, and the full contents of /etc/passwd and /etc/hosts, then sends them as JSON in an HTTPS POST to `187d714jo62z5j5c39hc437myd44sxgm.oastify.com`, a Burp Collaborator endpoint. The npm account testneo7755 published it on 2026-10-05 and it was unpublished 56 seconds later; the same account published checkmate-remediation-assistant the same day with the same index.js and a different Collaborator subdomain.\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (8eceeb0a05cd8d1a289f1a1006df8acd825d73f341ec1a50e095dc2850b866c8)\nThe package declares a preinstall lifecycle hook (`preinstall: node index.js`) that runs automatically on `npm install`. index.js collects installer host identifiers (os.hostname, os.userInfo, homedir, DNS servers) and reads the contents of /etc/passwd and /etc/hosts, then POSTs the collected data over HTTPS to the Burp Collaborator subdomain 187d714jo62z5j5c39hc437myd44sxgm.oastify.com. The package otherwise contains no library code, has empty author/description metadata, and provides no functionality — the shipped surface is solely the install-time beacon, consistent with a dependency-confusion or internal-name squat probe.\n","state":0,"publishedAt":"2026-10-05T08:04:30+00:00","modifiedAt":"2026-10-07T06:30:04.9427361+00:00","affected":[{"ecosystem":"npm","name":"with-cte","ranges":[],"versions":["1.0.0"],"rawVersionEvidence":null}],"metrics":[],"references":["https://www.npmjs.com/package/with-cte/v/1.0.0","https://www.npmjs.com/package/with-cte"],"sourceUrl":"https://osv.dev/vulnerability/MAL-2026-17579","license":"OSV · upstream source license applies","key":"osv:MAL-2026-17579","identifiers":["MAL-2026-17579"]},"retained":false,"historicalAffected":[]}],"coverage":[]}