MAL-2026-6699

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/ecto-corsair-flag-7kq3mz/MAL-2026-6699.json
JSON Data
https://api.test.osv.dev/v1/vulns/MAL-2026-6699
Published
2026-06-30T21:00:23Z
Modified
2026-06-30T21:46:37.555507336Z
Summary
Malicious code in ecto-corsair-flag-7kq3mz (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (2a4dfa9f4805e5b44c7ccf3e4c3859abf8e9f0388f11e3daf6065f43c49e09ed)

Package wires preinstall, install, and postinstall lifecycle hooks to run postinstall.js, which executes unconditionally on npm install. The script collects hostname, cwd, uid, and environment variables matching FLAG/CTF/NPM/REGISTRY/CI/GITHUB/RUNNER, reads candidate flag files, and uses childprocess.execSync to recursively grep installer-side directories (/app, /workspace, /challenge, /home/runner/work/repo/repo,.,..,../..) for flag-shaped strings. The collected manifest is base64-encoded and PUT to http://154.57.164.76:30728/api/modules/<id>, with an additional GET beacon to webhook.site/755defab-ea42-4c1f-9804-43ec567439f5. postinstall.js also tests npmconfig_registry against /verdaccio/i to detect successful dependency-confusion landings, and the shipped publish-and-arm.sh and README self-describe the package as an 'armed' dependency-confusion probe. Regardless of the CTF/probe framing, installing this package causes unconsented exfiltration of installer environment and filesystem contents to an attacker-controlled IP.

Database specific 
{
    "malicious-packages-origins": [
        {
            "source": "amazon-inspector",
            "versions": [
                "1.0.2"
            ],
            "id": "IN-MAL-2026-007821",
            "modified_time": "2026-06-30T21:00:23Z",
            "sha256": "2a4dfa9f4805e5b44c7ccf3e4c3859abf8e9f0388f11e3daf6065f43c49e09ed",
            "import_time": "2026-06-30T21:35:50.716175169Z"
        },
        {
            "source": "amazon-inspector",
            "sha256": "54d9460656276821368471252c6a7b1c42dc2fdfd89432aa796d71d5463a1fc7",
            "modified_time": "2026-06-30T21:00:30Z",
            "versions": [
                "1.0.0"
            ],
            "id": "IN-MAL-2026-007822",
            "import_time": "2026-06-30T21:35:50.814129246Z"
        },
        {
            "source": "amazon-inspector",
            "sha256": "b18aadaf5087b19b63d12456642141e5bfff9146bf1bf4fcfb11eed833b8c78c",
            "modified_time": "2026-06-30T21:00:38Z",
            "versions": [
                "1.0.1"
            ],
            "id": "IN-MAL-2026-007823",
            "import_time": "2026-06-30T21:35:50.916792534Z"
        }
    ]
}
References
Credits

Affected packages

npm / ecto-corsair-flag-7kq3mz

Package

Name
ecto-corsair-flag-7kq3mz
View open source insights on deps.dev
Purl
pkg:npm/ecto-corsair-flag-7kq3mz

Affected ranges

Affected versions

1.*
1.0.0
1.0.1
1.0.2

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/ecto-corsair-flag-7kq3mz/MAL-2026-6699.json"
indicators 
{
    "evidence_files": [
        {
            "tlsh": "3781a59dbbf594a501d5b9846217640bbeefd627352eacd07a8c03f02fdc1b810b169d",
            "sha256": "9ca7a71fe48ba9a34e4e71ee46a5e39d0b189a1cf9e3406e7b2d4b7e9888ca19",
            "path": "postinstall.js"
        },
        {
            "tlsh": "1431a68b71357173806ddb55b900533217f3b6ab672fb811e8dd34ed135a0f6a27a006",
            "sha256": "914443bf677378da4945a821de28a7c91db637e39e275a3b30ee317b179e47cf",
            "path": "publish-and-arm.sh"
        }
    ],
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-PKRdQchYOdl1qlXamo4BYdDyC8dCsdiaq6A/c1dJ2qJgvMSKoviVFO7SvWsKLAdBFC4i4VY9Is6f8Nn314BzCg==",
                "sha1": "b38b01ea5ee92d0c53120e122137a7fb672431f3"
            },
            "filename": "ecto-corsair-flag-7kq3mz-1.0.2.tgz"
        }
    ]
}
cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]