color-convert-helper
This report shows the evidence for color-convert-helper@1.0.0, the only known version.
OpenSSF/OSV Malicious Advisory
imported 3mo ago · by OpenSSF/OSVOpenSSF/OSV advisory MAL-2026-11134 confirms this npm version as malicious.
Advisory
MAL-2026-11134
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in color-convert-helper (npm)
Details
The package's postinstall.js runs automatically on npm install and executes a shell pipeline that collects host identity (hostname, whoami, id, sudo -l, uname), CI/GitHub Actions environment variables, network interface information, running processes, and environment variables filtered by KEY/TOKEN/SECRET/CREDENTIAL/NPM/AZURE/GCP/CLOUD, then queries cloud instance-metadata endpoints (AWS/Aliyun/GCP/Tencent at 169.254.169.254) to fetch IAM security credentials. The collected data is base64-encoded and curled to the hardcoded attacker-controlled OAST domain pzs5w7ntzhsnepwk564lyfdci3oucl0a.oastify.com. The script also performs DNS and HTTP probes against the internal hostname tst.woa.com and issues an SSRF forwarder request, reporting resolvability back to the same OAST domain. The advertised purpose of the package is color conversion; the actual behavior is credential and cloud-IAM harvesting plus internal-perimeter reconnaissance from every install host.
References
Source & flagged code
0 flagged · loading sourceNo flagged code excerpts are attached to this scan.
Findings
1 High
HighOsv Malicious Advisory
Affected versions and remediation
This report applies to color-convert-helper@1.0.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing color-convert-helper@1.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
This report uses published external intelligence. The advisory does not provide a separate source-code analysis for each listed version.
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.