{"answers":{"affected":"1 open source package ship an affected version, including amundi-compare.","exploited":"There is no known exploitation of MAL-2026-14390 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-14390 is a malicious package in amundi-compare, published on 24 Aug 2026."},"fix_prompt":"MAL-2026-14390 is a malicious package: amundi-compare (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-14390/ (Markdown: https://insights.sbomify.com/MAL-2026-14390/index.md)","id":"MAL-2026-14390","markdown":"https://insights.sbomify.com/MAL-2026-14390/index.md","name":"MAL-2026-14390","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"amundi-compare@999.9.12 is published at an inflated version number consistent with dependency-confusion targeting of an internal package name. The package.json declares a preinstall hook (`node index.js`) that runs automatically on `npm install`. index.js collects hostname, OS user, home directory, current working directory, local IPv4 addresses, public egress IP (queried from api.ipify.org, icanhazip.com, and ifconfig.me), the DNS resolver IP and client subnet, and the parent project's package.json name/author/repository/homepage fields. The payload is transmitted through three parallel channels to the hardcoded callback host da51rv0hb2uc72tg4gvgdepinjcallbk1.oast.fun: an HTTP POST, an HTTPS POST to /poc/\u003cuuid\u003e, and a DNS covert channel that hex-encodes the JSON, splits it into \u003c=60-character chunks, and emits each chunk as a subdomain label under the callback domain. The DNS channel is designed to bypass egress filters that block outbound HTTP. The package labels itself as authorized security research, but the callback host is not installer-configured and the parent project's metadata is captured without consent.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in amundi-compare (npm)","id":"MAL-2026-14390","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":[],"last_affected":[],"package":"amundi-compare","purl":"pkg:npm/amundi-compare","source":"MAL-2026-14390"}],"products":null,"published":"2026-08-24","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-14390/"}