{"id":"MAL-2026-19220","kind":"package","aliases":["MAL-2026-19220"],"related":[],"title":"Malicious code in @securihackbot/depconf-flow-1792484611 (npm)","description":"---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (6dc8c3628b1d44eca51a5cde6143c1760a5d393b45729f174bab73f76f8641e8)\nPackage publishes under the `@securihackbot` scope as a public dependency-confusion squat of an internal name. The declared `postinstall` script executes `postinstall.js`, which on `npm install` collects host identifiers (os.hostname(), USER/USERNAME, platform, arch, node version, package name, and a nonce), base64-encodes them, and sends them as a query parameter via plain-HTTP GET to a hardcoded bare-IP collector at http://34.143.131.27:18080/. A DNS-exfil fallback resolves NONCE-prefixed subdomains under a configured DNS suffix. The exfiltration fires automatically on install with no opt-in, and any build host whose resolver pulls this public tarball instead of an intended internal `@securihackbot/*` package will beacon host metadata to the hardcoded collector. The 'authorized research' framing in the README does not gate the behavior, which runs against any installer that resolves this version.","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"@securihackbot/depconf-flow-1792484611","fixed":[],"affected":"= 1.2.1","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-13T03:44:30+00:00","first_seen_at":"2026-11-13T05:11:56+00:00","triaged_at":"2026-11-13T05:12:56+00:00","updated_at":"2026-11-13T05:14:00+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-19220':8A,11A '-2026':7A,10A '18080':95C '34.143.131.27':94C '6dc8c3628b1d44eca51a5cde6143c1760a5d393b45729f174bab73f76f8641e8':28C 'amazon':26C 'amazon-inspector':25C 'arch':62C 'author':148C 'automat':114C 'bare':90C 'bare-ip':89C 'base64':71C 'base64-encodes':70C 'beacon':140C 'behavior':158C 'build':124C 'code':2A 'collect':56C 'collector':92C,146C 'configur':108C 'confus':40C 'declar':47C 'depend':39C 'dependency-confus':38C 'detail':17C 'dns':98C,109C 'dns-exfil':97C 'edit':20C 'encod':72C 'execut':50C 'exfil':99C 'exfiltr':112C 'fallback':100C 'fire':113C 'frame':150C 'gate':156C 'get':85C 'hardcod':88C,145C 'host':57C,125C,141C 'http':84C 'identifi':58C 'inspector':27C 'instal':55C,116C,163C 'instead':132C 'intend':135C 'intern':44C,136C 'ip':91C 'line':23C 'mal':6A,9A 'malici':1A,13B 'metadata':142C 'name':45C,66C 'node':63C 'nonc':69C,103C 'nonce-prefix':102C 'npm':5A,54C 'opt':120C 'opt-in':119C 'os.hostname':59C 'packag':14B,29C,65C,138C 'paramet':80C 'per':15C 'plain':83C 'plain-http':82C 'platform':61C 'postinstal':48C 'postinstall.js':51C 'prefix':104C 'public':37C,130C 'publish':30C 'pull':128C 'queri':79C 'readm':153C 'research':149C 'resolv':101C,127C,165C 'run':160C 'scope':34C 'script':49C 'securihackbot':33C,137C 'securihackbot/depconf-flow-1792484611':4A,12A 'send':75C 'sourc':16C,24C 'squat':41C 'subdomain':105C 'suffix':110C 'tarbal':131C 'user/username':60C 'version':64C,167C 'via':81C 'whose':126C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["depconfflow1792484611"],"ptokens":["1792484611","depconf","flow","securihackbot"],"labels":["critical","malicious","npm","package"],"campaign_type":null,"search_a":"'-19220':8A,11A '-2026':7A,10A 'code':2A 'mal':6A,9A 'malici':1A 'npm':5A 'securihackbot/depconf-flow-1792484611':4A,12A","search_b":"'malici':13B 'packag':14B","search_c":"'18080':95C '34.143.131.27':94C '6dc8c3628b1d44eca51a5cde6143c1760a5d393b45729f174bab73f76f8641e8':28C 'amazon':26C 'amazon-inspector':25C 'arch':62C 'author':148C 'automat':114C 'bare':90C 'bare-ip':89C 'base64':71C 'base64-encodes':70C 'beacon':140C 'behavior':158C 'build':124C 'collect':56C 'collector':92C,146C 'configur':108C 'confus':40C 'declar':47C 'depend':39C 'dependency-confus':38C 'detail':17C 'dns':98C,109C 'dns-exfil':97C 'edit':20C 'encod':72C 'execut':50C 'exfil':99C 'exfiltr':112C 'fallback':100C 'fire':113C 'frame':150C 'gate':156C 'get':85C 'hardcod':88C,145C 'host':57C,125C,141C 'http':84C 'identifi':58C 'inspector':27C 'instal':55C,116C,163C 'instead':132C 'intend':135C 'intern':44C,136C 'ip':91C 'line':23C 'metadata':142C 'name':45C,66C 'node':63C 'nonc':69C,103C 'nonce-prefix':102C 'npm':54C 'opt':120C 'opt-in':119C 'os.hostname':59C 'packag':29C,65C,138C 'paramet':80C 'per':15C 'plain':83C 'plain-http':82C 'platform':61C 'postinstal':48C 'postinstall.js':51C 'prefix':104C 'public':37C,130C 'publish':30C 'pull':128C 'queri':79C 'readm':153C 'research':149C 'resolv':101C,127C,165C 'run':160C 'scope':34C 'script':49C 'securihackbot':33C,137C 'send':75C 'sourc':16C,24C 'squat':41C 'subdomain':105C 'suffix':110C 'tarbal':131C 'user/username':60C 'version':64C,167C 'via':81C 'whose':126C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T03:44:30+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-19220","url":"https://osv.dev/vulnerability/MAL-2026-19220","severity":"critical","published_at":"2026-11-13T03:44:30+00:00","modified_at":"2026-11-13T04:30:07+00:00","first_seen_at":"2026-11-13T05:11:56+00:00","fetched_at":"2026-11-13T05:11:56+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}