techportal

GHSA-649g-mjr9-4j74

Malicious code in techportal (npm)

Details

**Severity:** Critical

**Affected versions:** `= 4.0.10`

## Source: amazon-inspector (2d947d5b4ddaa0ea6a25488fb5b5a66b3afc5c8f56d5ac38fb2e95e4b23242f3)
package.json declares a preinstall hook (`node beacon.js`) that fires automatically on `npm install`. beacon.js reads os.hostname(), os.userInfo().username, and process.cwd(), base32-encodes them, and issues an HTTP GET to a hardcoded bare-IP callback URL http://45.76.249.245/beacon/<token>/techportal/4.0.10, carrying the values in X-Bug-Bounty-Host, X-Bug-Bounty-User, and X-Bug-Bounty-Path headers. If the HTTP beacon fails or times out, the same identifiers are packed as base32-encoded DNS subdomain labels and queried (resolve4/resolve6/resolveTxt) against three hardcoded `*.oob.asm5.net` collector domains, providing a DNS-tunneling channel that bypasses HTTP egress controls. Destination is not caller-configurable and there is no install-time opt-in. Self-labeling of the beacon as an authorized bug bounty or dual-use tool does not change the data flow: installer host identity leaves the installer's machine on `npm install` to hardcoded attacker-operated infrastructure.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/e4956292c0cf024519ebae88e8b315a0af37a829/osv/malicious/npm/techportal/MAL-2026-15561.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/e4956292c0cf024519ebae88e8b315a0af37a829/osv/malicious/npm/techportal/MAL-2026-15561.json
- https://www.npmjs.com/package/techportal/v/4.0.10
- https://github.com/advisories/GHSA-649g-mjr9-4j74

Compromised versions (1)

= 4.0.10

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.