{"answers":{"affected":"1 open source package ship an affected version, including application_base.","exploited":"There is no known exploitation of MAL-2026-12511 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-12511 is a malicious package in application_base, published on 5 Aug 2026."},"fix_prompt":"MAL-2026-12511 is a malicious package: application_base (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-12511/ (Markdown: https://insights.sbomify.com/MAL-2026-12511/index.md)","id":"MAL-2026-12511","markdown":"https://insights.sbomify.com/MAL-2026-12511/index.md","name":"MAL-2026-12511","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"application_base@9999.0.0 runs callback.js from its preinstall lifecycle hook on `npm install`. The script collects os.hostname(), os.userInfo().username, process.cwd(), the configured npm registry, and CI repo-slug environment variables (GITHUB_REPOSITORY, CI_PROJECT_PATH, BUILD_REPOSITORY_NAME, BITBUCKET_REPO_FULL_NAME, TRAVIS_REPO_SLUG, DRONE_REPO, BUILDKITE_PIPELINE_SLUG, CIRCLE_PROJECT_REPONAME, JOB_NAME), and issues an HTTP GET to http://75.119.137.232:31337/depconfuse with those values as query parameters. The bare-IP plain-HTTP destination is not a first-party telemetry endpoint. Combined with the 9999.0.0 version overshoot and the `depconfuse` path, this is a dependency-confusion reconnaissance beacon: it signals to the attacker whether an internal package name resolved to their public registry entry inside a target's build environment, along with the host, user, working directory, and CI repository identity needed to target that organization for a follow-on internal-package hijack.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in application_base (npm)","id":"MAL-2026-12511","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":[],"last_affected":[],"package":"application_base","purl":"pkg:npm/application_base","source":"MAL-2026-12511"}],"products":null,"published":"2026-08-05","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-12511/"}