MAL-2026-14370

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@usaa-grp-personal-profile/personal-profile-common/MAL-2026-14370.json
JSON Data
https://api.test.osv.dev/v1/vulns/MAL-2026-14370
Published
2026-08-23T03:15:23Z
Modified
2026-08-23T03:30:18.744285127Z
Summary
Malicious code in @usaa-grp-personal-profile/personal-profile-common (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (de7570e75b52c8d98aef5a71ab1b1183991359e7e3e1864befba58a9f5ca630a)

Package published to public npm under an internal-looking scope (@usaa-grp-personal-profile) at version 999.0.0, a shape consistent with dependency-confusion targeting an organization's internal registry. package.json declares preinstall and postinstall hooks that execute beacon.js on npm install. beacon.js reads os.hostname(), os.userInfo().username, and process.cwd(), hex-encodes them into DNS labels, and issues dns.lookup queries against a subdomain of oastify.com (Burp Collaborator out-of-band service), transmitting installer host, user, and working-directory identifiers to a third-party OAST endpoint on every install. The exfiltration fires automatically without user invocation and reaches an attacker-controllable Collaborator subdomain regardless of any research/PoC framing in the package metadata.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-018574",
            "sha256": "de7570e75b52c8d98aef5a71ab1b1183991359e7e3e1864befba58a9f5ca630a",
            "modified_time": "2026-08-23T03:15:23Z",
            "versions": [
                "999.0.0"
            ],
            "import_time": "2026-08-23T03:25:56.668720026Z",
            "source": "amazon-inspector"
        }
    ]
}
References
Credits

Affected packages

npm / @usaa-grp-personal-profile/personal-profile-common

Package

Name
@usaa-grp-personal-profile/personal-profile-common
View open source insights on deps.dev
Purl
pkg:npm/%40usaa-grp-personal-profile/personal-profile-common

Affected ranges

Affected versions

999.*
999.0.0

Database specific

indicators 
{
    "evidence_files": [
        {
            "sha256": "191a1e877b13ebc08056d6eb468579d409d5d20942ea05ebf29b5069f36d7e09",
            "path": "beacon.js",
            "tlsh": "f411462a8d64b57533a321805b9f11c2b52283660085eb51945b9258ee8a6f45b32eed"
        },
        {
            "sha256": "897c1acd2eee979fe94730794d609f06654dc9acc83befd8493c0dafcf7f71b5",
            "path": "package.json",
            "tlsh": "2ce0ab698c142d2334ca7ed16873a50f21764e9b31642c0402db4098118d7aa86ffa3f"
        }
    ],
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-gfg4xFUR14K049poHWCwwsk7JCvn9b9h0GfeUzlSYnSzPDRfnJxe/QcCzZH4jI28Hlv7hSjcN9j3tJ3s9L5aGw==",
                "sha1": "78101cf752c260758ecc125a19a50ded1a5425b5"
            },
            "filename": "personal-profile-common-999.0.0.tgz"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@usaa-grp-personal-profile/personal-profile-common/MAL-2026-14370.json"
cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]