{"id":"MAL-2026-17746","revision":"981a7407caa1491ea81d3c835fcef185","records":[{"revision":"981a7407caa1491ea81d3c835fcef185","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"MAL-2026-17746","aliases":[],"title":"Malicious code in kmf-bootstrap (npm)","description":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (b95cb55a24f11248b1635861f0a10a3cb41bc4ee6ac7e2100439ca7c947bba74)\nOn npm install, the package's postinstall script performs two exfiltration actions. First, it reads the installer's hostname and npm_package_name and issues DNS resolutions for a label of the form <host>.<pkg>.db4jlbku53082dmp0d7g3mffj7s7aordk.oast.me, leaking those identifiers to an Interactsh (oast.me) collaborator over DNS. Second, postinstall.js require()s a shipped Linux x64 native addon at prebuilds/linux-x64/addon.node that calls gethostname() and getpwuid()->pw_name and reads the npm_package_name and npm_config_registry environment variables, then opens a raw socket and sends an HTTP POST with body h=<host>&u=<user>&p=<pkg>&r=<registry> to the bare IP 64.181.165.115 (Host header 64.181.165.115, path /dc, HTTP/1.0, no TLS). The destination is a bare IP with no relation to the package publisher and the npm_config_registry value can disclose a private/internal registry URL from the installer's.npmrc. The native component is opaque code auto-executed during install with host-level network egress. The package name resembles the common 'bootstrap' naming convention, consistent with a dependency-confusion / typosquat lure whose purpose is to beacon successful installs and private registry metadata.\n\n## Source: ossf-package-analysis (4a4e085f9bdddf6800e613b7cdfeb6b2481b2fe9bf0ccb2a5b1bffad9538194b)\nThe OpenSSF Package Analysis project identified 'kmf-bootstrap' @ 100.100.102 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package communicates with a domain associated with malicious activity.\n","state":0,"publishedAt":"2026-10-09T19:10:34+00:00","modifiedAt":"2026-10-11T14:30:09.3363318+00:00","affected":[{"ecosystem":"npm","name":"kmf-bootstrap","ranges":[],"versions":["100.100.102","100.100.103","100.100.106","100.100.101","100.100.100"],"rawVersionEvidence":null}],"metrics":[],"references":["https://www.npmjs.com/package/kmf-bootstrap/v/100.100.106","https://www.npmjs.com/package/kmf-bootstrap/v/100.100.101","https://www.npmjs.com/package/kmf-bootstrap/v/100.100.103","https://www.npmjs.com/package/kmf-bootstrap/v/100.100.102","https://www.npmjs.com/package/kmf-bootstrap/v/100.100.100"],"sourceUrl":"https://osv.dev/vulnerability/MAL-2026-17746","license":"OSV · upstream source license applies","key":"osv:MAL-2026-17746","identifiers":["MAL-2026-17746"]},"retained":false,"historicalAffected":[]}],"coverage":[]}