{
  "affected": [
    {
      "database_specific": {
        "cwes": [
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          },
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          }
        ],
        "indicators": {
          "evidence_files": [
            {
              "path": "index.js",
              "sha256": "17a8dbe1504773d6f3bbe29b27a7c2cde02b26c2c486887038bcdcba5fa89f85",
              "tlsh": "8ff0dce592b5f4507232a4c8d20e90096293e0802280ced0419ed0e05da1a681702ef8"
            }
          ],
          "package_integrity": [
            {
              "filename": "utils-1.0.1.tgz",
              "hashes": {
                "sha1": "97a07d7682334b9d831a20dff1fbe412df8128de",
                "sha512_sri": "sha512-VxYgIbqPKFaRFhZZxN+6vEK8mjmBkMzOfdYavryA4G/LaVVOVMNZ7Agv3KPk+jIX1GlXWHgs8MD4WVddAu373g=="
              }
            }
          ]
        }
      },
      "package": {
        "ecosystem": "npm",
        "name": "@onum-releases/utils"
      },
      "versions": [
        "1.0.1",
        "1.0.2"
      ]
    }
  ],
  "credits": [
    {
      "contact": [
        "inspector-research@amazon.com"
      ],
      "name": "Amazon Inspector",
      "type": "FINDER"
    }
  ],
  "database_specific": {
    "malicious-packages-origins": [
      {
        "id": "IN-MAL-2026-007002",
        "import_time": "2026-06-18T17:08:47.550328116Z",
        "modified_time": "2026-06-18T16:15:27Z",
        "sha256": "057e9534a55fd4068aaffb080224c08a14689dedbeb0737bda03a4c3bbc14a63",
        "source": "amazon-inspector",
        "versions": [
          "1.0.1"
        ]
      },
      {
        "id": "IN-MAL-2026-007001",
        "import_time": "2026-06-18T17:08:47.431910813Z",
        "modified_time": "2026-06-18T16:15:26Z",
        "sha256": "887866a4734ebf64a639f9d2512cd400085469ec7fa06aba5f1bbe340b2688b8",
        "source": "amazon-inspector",
        "versions": [
          "1.0.2"
        ]
      }
    ]
  },
  "details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (887866a4734ebf64a639f9d2512cd400085469ec7fa06aba5f1bbe340b2688b8)\nOn require(\u0027@onum-releases/utils\u0027), index.js reads os.hostname() and issues an HTTP GET to \u0027utils.\u003chostname\u003e.200majoeu01dk02xnjdajro1isojc90y.oastify.com\u0027, leaking the installer\u0027s hostname via DNS and HTTP to an out-of-band collaborator endpoint controlled by the package publisher. The beacon fires unconditionally on module load, so any consumer that imports the package exposes its host identifier to the attacker-controlled collaborator. The package.json description claims \u0027Security PoC placeholder - benign, no runtime payload\u0027, directly contradicting the shipped code. The scope \u0027@onum-releases\u0027 impersonates the Onum vendor namespace, consistent with a dependency-confusion lure aimed at that organization\u0027s developers.\n",
  "id": "MAL-2026-6127",
  "modified": "2026-06-18T17:10:53Z",
  "published": "2026-06-18T16:15:26Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/@onum-releases/utils/v/1.0.1"
    },
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/@onum-releases/utils/v/1.0.2"
    }
  ],
  "schema_version": "1.7.4",
  "summary": "Malicious code in @onum-releases/utils (npm)"
}