{"answers":{"affected":"1 open source package ship an affected version, including gs-uitk-object-utils.","exploited":"There is no known exploitation of MAL-2026-12791 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-12791 is a malicious package in gs-uitk-object-utils, published on 5 Aug 2026."},"fix_prompt":"MAL-2026-12791 is a malicious package: gs-uitk-object-utils (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-12791/ (Markdown: https://insights.sbomify.com/MAL-2026-12791/index.md)","id":"MAL-2026-12791","markdown":"https://insights.sbomify.com/MAL-2026-12791/index.md","name":"MAL-2026-12791","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"package.json declares scripts.install: `node index.js`, which requires `./lib/core`. lib/core.js reads the OS username, hostname, and current working-directory basename, assembles them with a hardcoded `goldman1` prefix into a subdomain of `oob.sl4x0.xyz`, and issues a `dns.resolve4` lookup against that name, causing the installer's host identifiers to be transmitted as a DNS query to the attacker-controlled authoritative server. The destination domain, prefix, and API names (`os`, `dns`, `userInfo`, `hostname`, `cwd`, `resolve4`) are stored as char-code arrays in lib/b02e30.js and lib/6ad264.js and decoded at runtime via String.fromCharCode, concealing the exfiltration path. The same code also fires on `require()` of the package. The package presents itself as an object-utility library, which does not match the observed install-time DNS beaconing.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in gs-uitk-object-utils (npm)","id":"MAL-2026-12791","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":[],"last_affected":[],"package":"gs-uitk-object-utils","purl":"pkg:npm/gs-uitk-object-utils","source":"MAL-2026-12791"}],"products":null,"published":"2026-08-05","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-12791/"}