amdocs-auth-package

Details

**Severity:** Critical

**Affected versions:** `>= 1.0.0`

The package communicates with a domain associated with malicious activity.## Source: amazon-inspector (5d16664451db45f3a8b8da108a2b38785d0a7471480df169c57b38bccde640f7)
Package name mimics an Amdocs internal package (dependency-confusion lure). package.json declares `preinstall: node index.js`, so `npm install` auto-executes index.js. index.js collects host reconnaissance via Node's os module and child_process (hostname, platform, arch, homedir, username/uid/gid/shell, OS info, plus output of `whoami`, `id`, and `pwd`) and POSTs the JSON payload to a hardcoded Burp Collaborator subdomain at https://bet2pv7fumnp3hnz9u5oxggb329txjl8.oastify.com/detox56. No legitimate functionality is present; the sole install-time effect is reconnaissance exfiltration to an attacker-controlled out-of-band callback host.

## Source: ossf-package-analysis (c756549e7fbf260738e6865ac35a33c132117c1e51d74abfe20fd5ab84cc5666)
The OpenSSF Package Analysis project identified 'amdocs-auth-package' @ 99.1.0 (npm) as malicious.

It is considered malicious because:

- The package communicates with a domain associated with malicious activity.

- The package executes one or more commands associated with malicious behavior.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/b9106eb680591c55d453ba1074d388eafca5b0f4/osv/malicious/npm/amdocs-auth-package/MAL-2025-6694.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/b9106eb680591c55d453ba1074d388eafca5b0f4/osv/malicious/npm/amdocs-auth-package/MAL-2025-6694.json
- https://www.npmjs.com/package/amdocs-auth-package/v/114.2.1
- https://www.npmjs.com/package/amdocs-auth-package/v/115.2.1
- https://github.com/advisories/GHSA-7338-hqf8-q857

Compromised versions (1)

• >= 1.0.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.