{
  "affected": [
    {
      "database_specific": {
        "cwes": [
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          },
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          },
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          }
        ],
        "indicators": {
          "evidence_files": [
            {
              "path": "index.js",
              "sha256": "6e5ac179cb554e98721365c79a3caa7198842aeff84bee0e047ce090fb31f503",
              "tlsh": "94f0abd6d2f9f1907132b4c9d65e0405a2a2f0902295cec04aafe1f66df1b281706ef8"
            }
          ],
          "package_integrity": [
            {
              "filename": "ixel-1.0.2.tgz",
              "hashes": {
                "sha1": "33353623275a9379387b051a7e58079d99af6ec5",
                "sha512_sri": "sha512-I//R82XQNfvPGzyuUzLv43AqowSoK1Gfm3uu9CMqPnmkJdqJ0tMYeP9GGwwIXmlfbxfDrwcMLZXvuszu8gp+mw=="
              }
            }
          ]
        }
      },
      "package": {
        "ecosystem": "npm",
        "name": "@onum-releases/ixel"
      },
      "versions": [
        "1.0.2",
        "1.0.3",
        "1.0.1"
      ]
    }
  ],
  "credits": [
    {
      "contact": [
        "inspector-research@amazon.com"
      ],
      "name": "Amazon Inspector",
      "type": "FINDER"
    }
  ],
  "database_specific": {
    "malicious-packages-origins": [
      {
        "id": "IN-MAL-2026-006995",
        "import_time": "2026-06-18T17:08:46.962833167Z",
        "modified_time": "2026-06-18T16:15:22Z",
        "sha256": "03f19785a8c7b4908b1bdab949073500ac828a2ccc3d34562cac16b4fce4a45b",
        "source": "amazon-inspector",
        "versions": [
          "1.0.2"
        ]
      },
      {
        "id": "IN-MAL-2026-007003",
        "import_time": "2026-06-18T17:08:47.614926762Z",
        "modified_time": "2026-06-18T16:15:32Z",
        "sha256": "0405bead6aa6dd628190974d5555a124113b2fc630e8a90f11be30a238af88d2",
        "source": "amazon-inspector",
        "versions": [
          "1.0.3"
        ]
      },
      {
        "id": "IN-MAL-2026-006994",
        "import_time": "2026-06-18T17:08:46.900116541Z",
        "modified_time": "2026-06-18T16:15:22Z",
        "sha256": "188c65369497c00333fc54291c970071044f3237a255387903a707cfd2711599",
        "source": "amazon-inspector",
        "versions": [
          "1.0.1"
        ]
      }
    ]
  },
  "details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (188c65369497c00333fc54291c970071044f3237a255387903a707cfd2711599)\nOn import, index.js reads os.hostname() and issues an HTTPS GET to `ixel.\u003chostname\u003e.200majoeu01dk02xnjdajro1isojc90y.oastify.com/ixel` (oastify.com is Burp Suite\u0027s Collaborator out-of-band interaction domain). The hostname is embedded as a DNS subdomain label, so the DNS resolution alone leaks the installer\u0027s hostname to an attacker-controlled nameserver regardless of whether the HTTP request succeeds. Any developer machine or CI runner that `require()`s this package \u2014 directly or transitively \u2014 sends a host identifier to the operator of the configured Collaborator instance. The package.json description (\"Security PoC placeholder - benign, no runtime payload\") contradicts the shipped code, and the `@onum-releases` scope appears designed to resemble a legitimate vendor releases namespace.\n",
  "id": "MAL-2026-6124",
  "modified": "2026-06-18T17:10:53Z",
  "published": "2026-06-18T16:15:22Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/@onum-releases/ixel/v/1.0.2"
    },
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/@onum-releases/ixel/v/1.0.3"
    },
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/@onum-releases/ixel/v/1.0.1"
    }
  ],
  "schema_version": "1.7.4",
  "summary": "Malicious code in @onum-releases/ixel (npm)"
}