# MAL-2026-6269: Malicious code in zomato-espresso (npm)


- **Type:** Malicious package
- **Package:** `zomato-espresso` (npm)
- **Published:** 22 Jun 2026

## What is MAL-2026-6269?

MAL-2026-6269 is a malicious package in zomato-espresso, published on 22 Jun 2026. 

### Official description

Package is a dependency-confusion lure targeting Zomato's internal namespace. package.json declares a preinstall hook that runs curl on every `npm install`, posting the installer's hostname (`hostname -f`), username (`whoami`), current working directory, and the entire process environment (base64-encoded via `env | base64 -w0`) over plain HTTP to an interactsh out-of-band collector at d8s0b82plbq3u5sb2vo0sb3a9obr4yjt7.oast.site. The URL path embeds the package name and the form fields exfiltrate `host`, `user`, `cwd`, and `env`, so any CI/developer environment that misresolves Zomato's internal package name to this public release leaks AWS keys, GITHUB_TOKEN, NPM_TOKEN, and any other secrets exposed in the environment. A preuninstall hook performs a similar host beacon. The package's own functionality is a stub (`index.js` exports only `{name, version}`); its sole purpose is the install-time beacon. The description string self-identifies as `Zomato's PDF generator service`, confirming the dependency-confusion reconnaissance intent against Zomato's private namespace.

## What should I do about MAL-2026-6269?

Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.

## Fix prompt for AI coding agents

```text
MAL-2026-6269 is a malicious package: zomato-espresso (npm). Every version was published to cause harm.

Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.

Reference: https://insights.sbomify.com/MAL-2026-6269/ (Markdown: https://insights.sbomify.com/MAL-2026-6269/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/MAL-2026-6269

---
From sbomify Insights: https://insights.sbomify.com/MAL-2026-6269/
Summaries are generated and may contain mistakes; the official description above is the record.