simplenewnpmpackage@1.0.2

OSV Malicious Advisory

imported 16d ago · by OpenSSF/OSV

OpenSSF/OSV advisory MAL-2026-16479 confirms this npm version as malicious. On require/import, index.js issues an HTTPS GET to a hardcoded interactsh OAST subdomain (dapnhid534ch06s9vpm0mbg1httu5gytc.oast.fun) with the installer's os.platform() and os.hostname() as query parameters. The package ships no other functionality; its main module exists solely to fire this out-of-band beacon on load. oast.fun is a public out-of-band interaction collector used to receive callbacks from targets, and...

Advisory

MAL-2026-16479

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in simplenewnpmpackage (npm)

Details

On require/import, index.js issues an HTTPS GET to a hardcoded interactsh OAST subdomain (dapnhid534ch06s9vpm0mbg1httu5gytc.oast.fun) with the installer's os.platform() and os.hostname() as query parameters. The package ships no other functionality; its main module exists solely to fire this out-of-band beacon on load. oast.fun is a public out-of-band interaction collector used to receive callbacks from targets, and the hardcoded subdomain is bound to a specific listener controlled by whoever published the package. This is the canonical dependency-confusion / namesquat probe pattern, in which a package is published to catch internal-name mis-resolutions and report back the host that installed it.

Decision reason

OpenSSF Malicious Packages via OSV confirms simplenewnpmpackage@1.0.2 as malicious (MAL-2026-16479): Malicious code in simplenewnpmpackage (npm)

References

OSV advisory PACKAGE

Source & flagged code

0 flagged

No flagged code excerpts are attached to this scan.

simplenewnpmpackage@1.0.2

OSV Malicious Advisory

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code