{"id":"MAL-2026-5780","revision":"8f7336056e7246d1830d56c01a471d7c","records":[{"revision":"8f7336056e7246d1830d56c01a471d7c","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"MAL-2026-5780","aliases":[],"title":"Malicious code in ing-feat-itsme-oidc-authentication (npm)","description":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (175d0dba1f70bc84bcd4e29b57e0f7831248582614cd146af7d1ea6d1d057cd5)\nOn npm install, package.json's preinstall hook executes poc.js, which collects os.hostname(), os.userInfo().username, process.cwd(), and process.platform, base64-encodes the values, and issues an HTTPS GET to https://d8ntv8plujrg25sttkvg31bowtxhm7ex7.oast.live/cb?id=<token>&d=<b64> — sending installer host, user, working directory, and platform to an external Burp Collaborator / interactsh subdomain without consent. The package is named to mimic an internal ING Bank namespace and pinned to version 99.99.99 to win resolution in dependency-confusion scenarios. Any developer or CI environment that resolves this name leaks identifying host data to an attacker-controlled collaborator endpoint. This matches the textbook dependency-confusion exfiltration pattern regardless of any authorization claim made by the author.\n\n## Source: ossf-package-analysis (3d1b5976b551d1bb1d1e882bae955ac83974003fbf49d579469dd1bd79672ae7)\nThe OpenSSF Package Analysis project identified 'ing-feat-itsme-oidc-authentication' @ 99.9.1 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package communicates with a domain associated with malicious activity.\n","state":0,"publishedAt":"2026-06-15T15:10:24+00:00","modifiedAt":"2026-10-20T04:00:04.5322791+00:00","affected":[{"ecosystem":"npm","name":"ing-feat-itsme-oidc-authentication","ranges":[],"versions":["99.99.99","99.9.1"],"rawVersionEvidence":null}],"metrics":[],"references":["https://www.npmjs.com/package/ing-feat-itsme-oidc-authentication/v/99.99.99"],"sourceUrl":"https://osv.dev/vulnerability/MAL-2026-5780","license":"OSV · upstream source license applies","key":"osv:MAL-2026-5780","identifiers":["MAL-2026-5780"]},"retained":false,"historicalAffected":[]}],"coverage":[]}