Malicious code in csa-mfa (npm)
Exploitation and risk
Source statusCISA KEV lists vulnerabilities known to be exploited. FIRST EPSS estimates the likelihood of exploitation in the next 30 days. An unavailable score does not mean zero risk.
Which CVEs have scores here?
This view includes predictions for CVE identifiers explicitly listed in public NuGet advisories. Microsoft release pages have their own prediction coverage. Check source status for the scope and latest checks.
No exploitation or prediction data is available here for these CVEs. This does not mean they are safe or unlikely to be exploited.
osv · MAL-2026-16175
Published--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (959d2728ff38a804033ca7e07235b3a14bce65bd0e948077ba148a53c6cccff9) package.json declares a preinstall script that runs wget against http://169.58.142.14:8080/ with query parameters populated by shell command substitution of whoami, ls, and hostname. On npm install this automatically transmits the installer's username, current-directory listing, and hostname to a hardcoded bare-IP HTTP endpoint unrelated to any legitimate publisher infrastructure. There is no functional package purpose served by this behavior. ## Source: ossf-package-analysis (a11e3bfb8822762235630fbc44ccd99a2ccd272eba3f16bf242b74c4eb1cdc86) The OpenSSF Package Analysis project identified 'csa-mfa' @ 1.1.16 (npm) as malicious. It is considered malicious because: - The package executes one or more commands associated with malicious behavior.
- Source published
- 15 Sep 2026 12:01:27 UTC
- Source modified
- 16 Sep 2026 10:30:56 UTC
- Saved here
- 24 Oct 2026 13:17:17 UTC
- Source terms
- OSV · upstream source license applies
Original source record · Cite this exact observation · Complete original publisher JSON
Source: osv · OSV · upstream source license applies. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.