registry / bytepack-probe-a7x3 / 1.0.0

bytepack-probe-a7x3@1.0.0

OSV Malicious Advisory

imported 19d ago · by OpenSSF/OSV

OpenSSF/OSV advisory MAL-2026-16364 confirms this npm version as malicious. package.json declares a dependency `leak-internal` whose source is the HTTPS tarball URL https://src-ssrf.bytedance.net/ssrf/probe.tgz rather than a registry version range. On `npm install`, npm fetches and installs whatever bytes that URL currently returns, executing any lifecycle scripts contained in the fetched tarball...

Advisory

MAL-2026-16364

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in bytepack-probe-a7x3 (npm)

Details

package.json declares a dependency `leak-internal` whose source is the HTTPS tarball URL https://src-ssrf.bytedance.net/ssrf/probe.tgz rather than a registry version range. On `npm install`, npm fetches and installs whatever bytes that URL currently returns, executing any lifecycle scripts contained in the fetched tarball. There is no version pin, no integrity hash, and no signature check, so the code executed on the installer's machine is whatever the operator of that host serves at the moment of install. The hostname suggests an SSRF-probe artifact hosted on an internal-looking domain, and the dependency name `leak-internal` together with the path segment `ssrf/probe.tgz` indicates the fetched payload is intended to run probing behavior inside the installer's network.

Decision reason

One or more suspicious static signals were detected.

References

OSV advisory PACKAGE PACKAGE

Decision evidence

public snapshot

Behavioral surface

SourceNo risky source behavior triggered.

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 117 B of source

Source & flagged code

1 flagged

package.jsonView file

•Remote tarball dependency specs: leak-internal@https://src-ssrf.bytedance.net/ssrf/probe.tgz

Medium

Remote Tarball Dependency

Package manifest contains a dependency pinned to a remote tarball URL.

package.jsonView on unpkg

Source & flagged code

1 flagged · loading source

package.jsonView file

•Remote tarball dependency specs: leak-internal@https://src-ssrf.bytedance.net/ssrf/probe.tgz

Medium

Remote Tarball Dependency

Package manifest contains a dependency pinned to a remote tarball URL.

package.jsonView on unpkg

Findings

1 Medium

MediumRemote Tarball Dependencypackage.json

Affected versions and remediation

This report applies to bytepack-probe-a7x3@1.0.0.

See version security history for other recorded verdicts.

Avoid installing bytepack-probe-a7x3@1.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-09-21 20:30:13.907Z (UTC).

Source advisory published: 2026-09-21 19:51:34.000Z (UTC).