registry / x509-escaping / 1.0.1

x509-escaping@1.0.1

OSV Malicious Advisory

imported 22d ago · by OpenSSF/OSV

OpenSSF/OSV advisory MAL-2025-889 confirms this npm version as malicious. package.json declares `preinstall: node index.js`, so on `npm install` the shipped index.js runs automatically. It collects hostname, username, home directory, DNS servers, and current working directory, and reads /etc/passwd and /etc/hosts via fs.readFileSync, then POSTs the bundle over HTTPS to the hardcoded host `agumuj6lhw9yqopq6npl1nlgu70yorcg.oastify.com` (a Burp Collaborator out-of-band subdomain)...

Advisory

MAL-2025-889

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in x509-escaping (npm)

Details

package.json declares `preinstall: node index.js`, so on `npm install` the shipped index.js runs automatically. It collects hostname, username, home directory, DNS servers, and current working directory, and reads /etc/passwd and /etc/hosts via fs.readFileSync, then POSTs the bundle over HTTPS to the hardcoded host `agumuj6lhw9yqopq6npl1nlgu70yorcg.oastify.com` (a Burp Collaborator out-of-band subdomain). The package name and single-purpose recon payload match the dependency-confusion reconnaissance pattern: no library functionality is shipped, only install-time data exfiltration to an attacker-controlled OOB host.

Decision reason

OpenSSF Malicious Packages via OSV confirms x509-escaping@1.0.1 as malicious (MAL-2025-889): Malicious code in x509-escaping (npm)

References

OSV advisory PACKAGE

Source & flagged code

0 flagged

No flagged code excerpts are attached to this scan.

Source & flagged code

0 flagged · loading source

No flagged code excerpts are attached to this scan.

Findings

1 High

HighOsv Malicious Advisory

Affected versions and remediation

This report applies to x509-escaping@1.0.1.

The same advisory and Firewall decision cover 4 recorded versions

0.0.0, 0.0.1, 0.0.2, 1.0.1

See version security history for other recorded verdicts.

Avoid installing x509-escaping@1.0.1. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-09-18 20:45:06.540Z (UTC).

Source advisory published: 2025-02-03 17:06:31.000Z (UTC).

This report uses published external intelligence. The advisory does not provide a separate source-code analysis for each listed version.