{"answers":{"affected":"1 open source package ship an affected version, including @klapp-about/routes.","exploited":"There is no known exploitation of MAL-2026-5411 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-5411 is a malicious package in @klapp-about/routes, published on 9 Jun 2026."},"fix_prompt":"MAL-2026-5411 is a malicious package: @klapp-about/routes (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-5411/ (Markdown: https://insights.sbomify.com/MAL-2026-5411/index.md)","id":"MAL-2026-5411","markdown":"https://insights.sbomify.com/MAL-2026-5411/index.md","name":"MAL-2026-5411","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"On `npm install`, the package's `preinstall` hook (`node index.js`) collects host and user identity data — `os.hostname()`, `os.userInfo().username`, `__dirname`, `process.cwd()`, pid, node version, platform, and architecture — and ships them to two attacker-controlled destinations: (a) an HTTP POST to a bare IP `http://172.201.213.59:9090/cb/klapp-about-routes` carrying the collected fields as JSON, and (b) a hex-encoded DNS lookup to `*.d8jbmnsqcfu78dfs8vdg34ohqhirb4pbg.oast.live` (interactsh out-of-band callback). The package name `@klapp-about/routes` and the unusually high version `99.0.0` are the canonical shape of a dependency-confusion attack — an internal-looking scope published to public npm at a version high enough to override a private resolver. Self-description as a 'security research / dependency-confusion PoC' does not change installer-side impact: any developer or CI system that misroutes installs to the public registry has their machine fingerprint shipped to the hardcoded IP and DNS callback service without consent.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in @klapp-about/routes (npm)","id":"MAL-2026-5411","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":[],"last_affected":[],"package":"@klapp-about/routes","purl":"pkg:npm/%40klapp-about%2Froutes","source":"MAL-2026-5411"}],"products":null,"published":"2026-06-09","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-5411/"}