{
  "affected": [
    {
      "database_specific": {
        "cwes": [
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          },
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          },
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          }
        ],
        "indicators": {
          "evidence_files": [
            {
              "path": "package.json",
              "sha256": "240b3e2b3ac75c7c8843ada46a18cd725a4bb231cc2532f56a892a7b982f0a86",
              "tlsh": "08e068b449fcfa7238c409d614722908b0b3d9651018ec01a7a312889a986fbaea753e"
            }
          ],
          "package_integrity": [
            {
              "filename": "utils-9.9.11.tgz",
              "hashes": {
                "sha1": "4b0af2f0613b19afb7feb5eb8688a30a67c9c9df",
                "sha512_sri": "sha512-61wJLz/GgFNKdPqfpInoISzCNf4yrkVoGPupD9cCXiQbIShv1x1VOQtMnSrgdVofMavP4nhbSz2VArYTiEeQuQ=="
              }
            }
          ]
        }
      },
      "package": {
        "ecosystem": "npm",
        "name": "@outmarket/utils"
      },
      "versions": [
        "9.9.9",
        "9.9.10",
        "9.9.11"
      ]
    }
  ],
  "credits": [
    {
      "contact": [
        "inspector-research@amazon.com"
      ],
      "name": "Amazon Inspector",
      "type": "FINDER"
    }
  ],
  "database_specific": {
    "malicious-packages-origins": [
      {
        "id": "IN-MAL-2026-007206",
        "import_time": "2026-06-23T14:23:03.39021976Z",
        "modified_time": "2026-06-23T14:12:09Z",
        "sha256": "09e0002479ff6c431a5c5bfe6971f2acd915245afac8075caf15023d52428b8f",
        "source": "amazon-inspector",
        "versions": [
          "9.9.9"
        ]
      },
      {
        "id": "IN-MAL-2026-007208",
        "import_time": "2026-06-23T14:23:03.606609157Z",
        "modified_time": "2026-06-23T14:12:15Z",
        "sha256": "2cd90f0d706cda01a5740f120f6e8d22ae57d907a5000854439c201b3c53a8c0",
        "source": "amazon-inspector",
        "versions": [
          "9.9.10"
        ]
      },
      {
        "id": "IN-MAL-2026-007378",
        "import_time": "2026-06-23T22:31:27.784954754Z",
        "modified_time": "2026-06-23T21:46:24Z",
        "sha256": "528f0f362b90e8b662e0bb0ca5a6620989560b97f74d9dd064a02cb1c7314bf4",
        "source": "amazon-inspector",
        "versions": [
          "9.9.11"
        ]
      }
    ]
  },
  "details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (2cd90f0d706cda01a5740f120f6e8d22ae57d907a5000854439c201b3c53a8c0)\npackage.json declares a postinstall lifecycle script that fires automatically on `npm install`. The inline `node -e` payload uses hex-encoded property names (`\\x6f\\x73` for `os`, `\\x68\\x6f\\x73\\x74\\x6e\\x61\\x6d\\x65` for `hostname`, `\\x75\\x73\\x65\\x72\\x49\\x6e\\x66\\x6f` for `userInfo`) to obscure that it reads `os.hostname()` and `os.userInfo().username`, then issues an HTTP GET to `http://208.87.128.25:8888/?h=\u003chostname\u003e\u0026u=\u003cusername\u003e`. The destination is a bare IPv4 over cleartext HTTP \u2014 not a publisher domain or known infrastructure. The package is published under the `@outmarket` scope with a description identifying it as a dependency-confusion proof-of-concept, but the on-install behavior is indistinguishable from a real dependency-confusion beacon: any installer who resolves this public package in place of an internal `@outmarket/utils` will leak host identity to the hardcoded endpoint. Hex obfuscation of standard Node API names is evasion, not a legitimate engineering choice.\n",
  "id": "MAL-2026-6292",
  "modified": "2026-06-23T22:33:13Z",
  "published": "2026-06-23T14:12:09Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/@outmarket/utils/v/9.9.9"
    },
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/@outmarket/utils/v/9.9.10"
    },
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/@outmarket/utils/v/9.9.11"
    }
  ],
  "schema_version": "1.7.4",
  "summary": "Malicious code in @outmarket/utils (npm)"
}