{"id":"MAL-2026-19226","kind":"package","aliases":["MAL-2026-19226"],"related":[],"title":"Malicious code in quickgreet (npm)","description":"---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (430a8463ba4e5ea6b5dcb99d7410212773157b1c609d78b5a43bdf0cf9cd6c1b)\npackage.json declares a postinstall lifecycle script that runs an inline Node command reading os.hostname() and issuing an HTTP GET to <hostname>.<subdomain>.oast.fun. The oast.fun service is an out-of-band interaction / callback collector used to confirm code execution and enumerate reachable installer environments; the hostname is embedded in the DNS label so it is captured by the operator's interactsh listener. The script performs no build, native-compile, or install task — its sole effect is to exfiltrate an installer identifier to an attacker-controlled OOB endpoint on every npm install.","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"quickgreet","fixed":[],"affected":"= 0.0.2","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-13T03:54:05+00:00","first_seen_at":"2026-11-13T05:11:56+00:00","triaged_at":"2026-11-13T05:12:56+00:00","updated_at":"2026-11-13T05:14:00+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-19226':8A,11A '-2026':7A,10A '430a8463ba4e5ea6b5dcb99d7410212773157b1c609d78b5a43bdf0cf9cd6c1b':28C 'amazon':26C 'amazon-inspector':25C 'attack':113C 'attacker-control':112C 'band':58C 'build':94C 'callback':60C 'captur':83C 'code':2A,65C 'collector':61C 'command':40C 'compil':97C 'confirm':64C 'control':114C 'declar':30C 'detail':17C 'dns':78C 'edit':20C 'effect':103C 'embed':75C 'endpoint':116C 'enumer':68C 'environ':71C 'everi':118C 'execut':66C 'exfiltr':106C 'get':47C 'hostnam':73C 'http':46C 'identifi':109C 'inlin':38C 'inspector':27C 'instal':70C,99C,108C,120C 'interact':59C 'interactsh':88C 'issu':44C 'label':79C 'lifecycl':33C 'line':23C 'listen':89C 'mal':6A,9A 'malici':1A,13B 'nativ':96C 'native-compil':95C 'node':39C 'npm':5A,119C 'oast.fun':49C,51C 'oob':115C 'oper':86C 'os.hostname':42C 'out-of-band':55C 'packag':14B 'package.json':29C 'per':15C 'perform':92C 'postinstal':32C 'quickgreet':4A,12A 'reachabl':69C 'read':41C 'run':36C 'script':34C,91C 'servic':52C 'sole':102C 'sourc':16C,24C 'task':100C 'use':62C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["quickgreet"],"ptokens":["quickgreet"],"labels":["critical","malicious","npm","package"],"campaign_type":null,"search_a":"'-19226':8A,11A '-2026':7A,10A 'code':2A 'mal':6A,9A 'malici':1A 'npm':5A 'quickgreet':4A,12A","search_b":"'malici':13B 'packag':14B","search_c":"'430a8463ba4e5ea6b5dcb99d7410212773157b1c609d78b5a43bdf0cf9cd6c1b':28C 'amazon':26C 'amazon-inspector':25C 'attack':113C 'attacker-control':112C 'band':58C 'build':94C 'callback':60C 'captur':83C 'code':65C 'collector':61C 'command':40C 'compil':97C 'confirm':64C 'control':114C 'declar':30C 'detail':17C 'dns':78C 'edit':20C 'effect':103C 'embed':75C 'endpoint':116C 'enumer':68C 'environ':71C 'everi':118C 'execut':66C 'exfiltr':106C 'get':47C 'hostnam':73C 'http':46C 'identifi':109C 'inlin':38C 'inspector':27C 'instal':70C,99C,108C,120C 'interact':59C 'interactsh':88C 'issu':44C 'label':79C 'lifecycl':33C 'line':23C 'listen':89C 'nativ':96C 'native-compil':95C 'node':39C 'npm':119C 'oast.fun':49C,51C 'oob':115C 'oper':86C 'os.hostname':42C 'out-of-band':55C 'package.json':29C 'per':15C 'perform':92C 'postinstal':32C 'reachabl':69C 'read':41C 'run':36C 'script':34C,91C 'servic':52C 'sole':102C 'sourc':16C,24C 'task':100C 'use':62C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T03:54:05+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-19226","url":"https://osv.dev/vulnerability/MAL-2026-19226","severity":"critical","published_at":"2026-11-13T03:54:05+00:00","modified_at":"2026-11-13T04:30:05+00:00","first_seen_at":"2026-11-13T05:11:56+00:00","fetched_at":"2026-11-13T05:11:56+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}