registry  /  ahooks-3.7.8  /  13.1.1

ahooks-3.7.8@13.1.1

OSV Malicious Advisory

scanned 3h ago · by OpenSSF/OSV

OpenSSF/OSV advisory MAL-2026-10620 confirms this npm version as malicious. Package published as `ahooks-3.7.8` at version `13.1.1` with empty author/description/license impersonates the legitimate `ahooks` React hooks library. `package.json` declares a `preinstall` hook that runs `node index.js`, which collects the installer's hostname, platform, architecture, username/uid/gid/shell, home directory, current working directory, and the output of `whoami` and `id`, and POSTs the JSON to the...

Advisory
MAL-2026-10620
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in ahooks-3.7.8 (npm)
Details
Package published as `ahooks-3.7.8` at version `13.1.1` with empty author/description/license impersonates the legitimate `ahooks` React hooks library. `package.json` declares a `preinstall` hook that runs `node index.js`, which collects the installer's hostname, platform, architecture, username/uid/gid/shell, home directory, current working directory, and the output of `whoami` and `id`, and POSTs the JSON to the hardcoded Burp Collaborator subdomain `https://q7y246t0aca8jr8vfs8c900s4jaay1mq.oastify.com/detox56`. The script auto-executes on `npm install` without any user interaction.
Decision reason
One or more suspicious static signals were detected.; source fingerprint signature matched known malicious package; routed for review
References
OSV advisoryPACKAGE

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessNetwork
Supply chain
HighEntropyStringsUrlStrings
ManifestNo manifest risk signals triggered.
scanned 1 file(s), 3.02 KB of source, external domains: q7y246t0aca8jr8vfs8c900s4jaay1mq.oastify.com

Source & flagged code

3 flagged · loading source
package.jsonView file
•scripts.preinstall = node index.js
High
Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg
index.jsView file
1const { exec } = require('child_process'); L2: const os = require('os'); L3: const https = require('https'); L4: const http = require('http'); ... L12: return new Promise((resolve, reject) => { L13: exec(command, (error, stdout, stderr) => { L14: if (error) { ... L30: pwd: '', L31: hostname: os.hostname(), L32: platform: os.platform(), ... L98: if (res.statusCode >= 200 && res.statusCode < 300) { L99: resolve({ statusCode: res.statusCode, body: responseData });
High
Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

index.jsView on unpkg · L1
•matchType = malicious_source_fingerprint_signature signature = a8c0a39e872fe207 signatureType = suspicious_hashes sourceLabel = Datadog matchedPackage = @zuora-marketing/zuora-marketing-website@2.0.0 matchedPath = index.js matchedIdentity = npm:[redacted]:2.0.0 similarity = 1.000 shingleOverlap = 1 summary = Datadog malicious npm corpus sample: samples/npm/malicious_intent/@zuora-marketing@zuora-marketing-website/2.0.0/2025-12-12-@zuora-marketing_zuora-marketing-website-v2.0.0.zip
High
Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

index.jsView on unpkg

Findings

3 High2 Medium3 Low
HighInstall Time Lifecycle Scriptspackage.json
HighSandbox Evasion Gated Capabilityindex.js
HighKnown Malware Source Fingerprint Signatureindex.js
MediumNetwork
MediumStructural Risk Force Deep Review
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings