{"id":"MAL-2026-17748","revision":"508b89efdf4241c9ab82e6bf9429a0f8","records":[{"revision":"508b89efdf4241c9ab82e6bf9429a0f8","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"MAL-2026-17748","aliases":[],"title":"Malicious code in test-account-portal-fe (npm)","description":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (0f7b6c3f1f6f212d75283827455926079593132bbd819dec884caed3e3b745ca)\nnpm package test-account-portal-fe@100.100.101 ships only a Linux x64 native addon at prebuilds/linux-x64/addon.node and loads it unconditionally from index.js via require('./prebuilds/linux-x64/addon'). No C/C++ source, binding.gyp, prebuild URL, or checksum accompanies the binary, and the stated purpose (\"Frontend utilities\") has no need for a native addon. On NAPI module init the addon forks and opens a socket to the hardcoded bare IP 64.181.165.115, issuing POST /dc HTTP/1.0 with a body of the form h=<hostname>&u=<unix-user>&p=<npm_package_name>&r=<npm_config_registry>, exfiltrating the installer's host identity, local username, consuming package name, and configured npm registry URL. ELF strings and imports (socket/connect/send/gethostname/getpwuid/getenv, symbol try_connect) corroborate the beacon. The package name and implausibly high version (100.100.101) alongside a placeholder description are consistent with a dependency-confusion probe against an internal account-portal-fe package: exfiltrating npm_config_registry is precisely how such a probe confirms resolution against a private registry. Installing or requiring this package automatically leaks installer identity and internal registry configuration to attacker-controlled infrastructure.\n\n## Source: ossf-package-analysis (5dd02103458df4faa2c37da43a76a468a0a22d591fb77c5d756e7d7496d68907)\nThe OpenSSF Package Analysis project identified 'test-account-portal-fe' @ 100.100.102 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package communicates with a domain associated with malicious activity.\n","state":0,"publishedAt":"2026-10-09T19:10:36+00:00","modifiedAt":"2026-10-13T07:45:14.8077514+00:00","affected":[{"ecosystem":"npm","name":"test-account-portal-fe","ranges":[],"versions":["100.100.102","100.100.100","100.100.101"],"rawVersionEvidence":null}],"metrics":[],"references":["https://www.npmjs.com/package/test-account-portal-fe/v/100.100.100","https://www.npmjs.com/package/test-account-portal-fe/v/100.100.102","https://www.npmjs.com/package/test-account-portal-fe/v/100.100.101"],"sourceUrl":"https://osv.dev/vulnerability/MAL-2026-17748","license":"OSV · upstream source license applies","key":"osv:MAL-2026-17748","identifiers":["MAL-2026-17748"]},"retained":false,"historicalAffected":[]}],"coverage":[]}