{"id":"MAL-2026-17771","revision":"3c80e6b1abfc4d6e87692fd97d05f4c7","records":[{"revision":"3c80e6b1abfc4d6e87692fd97d05f4c7","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"MAL-2026-17771","aliases":[],"title":"Malicious code in ksp-client-registry (npm)","description":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (3b11a639f5149e4b1c17e64eb78f226abece5ed03152b5933333a3cb56284018)\nThe npm package ksp-client-registry@100.100.100 ships a prebuilt native addon at prebuilds/linux-x64/addon.node that is loaded by the package main (index.js require of./prebuilds/linux-x64/addon). On load the addon reads the HOSTNAME, npm_package_name, and npm_config_registry environment variables and opens a raw TCP socket to the hardcoded IP 64.181.165.115, sending them in an HTTP request of the form 'POST /dc HTTP/1.0' with a body shaped as 'h=<hostname>&p=<package>&u=<user>&r=<registry>'. ELF strings corroborate the behavior: '64.181.165.115', 'POST /dc HTTP/1.0', 'Host: 64.181.165.115', 'HOSTNAME', 'npm_package_name', 'npm_config_registry', and imports of socket/connect/send/fork/getenv/inet_pton. package.json declares a postinstall ('node postinstall.js') providing an install-time footprint, and any require() of the package triggers the beacon regardless. The addon exposes no legitimate N-API functionality beyond module registration. The implausibly high version (100.100.100) and generic registry-style name are consistent with a dependency-confusion probe designed to be resolved in place of an internal package and to report back the victim host, internal package name, and configured registry URL to the operator.\n","state":0,"publishedAt":"2026-10-11T13:56:54+00:00","modifiedAt":"2026-10-11T14:30:09.1714715+00:00","affected":[{"ecosystem":"npm","name":"ksp-client-registry","ranges":[],"versions":["100.100.100","100.100.101"],"rawVersionEvidence":null}],"metrics":[],"references":["https://www.npmjs.com/package/ksp-client-registry/v/100.100.100","https://www.npmjs.com/package/ksp-client-registry/v/100.100.101"],"sourceUrl":"https://osv.dev/vulnerability/MAL-2026-17771","license":"OSV · upstream source license applies","key":"osv:MAL-2026-17771","identifiers":["MAL-2026-17771"]},"retained":false,"historicalAffected":[]}],"coverage":[]}