amdocs-core-package

GHSA-74cw-xf4j-82c6

Malicious code in amdocs-core-package (npm)

Details

**Severity:** Critical

**Affected versions:** `= 11.11.11`

The package communicates with a domain associated with malicious activity.## Source: amazon-inspector (1e196068c171b8528ec4f1f0db852ef32a7b530ecce14d79696a21c4f685c2c6)
The package declares a preinstall hook that runs index.js on npm install. index.js requires https and os, reads os.hostname(), and issues an https.request POST to a hardcoded *.oastify.com Burp Collaborator subdomain, additionally embedding the hostname into the DNS label of that subdomain for out-of-band capture. Package metadata is placeholder (empty description and author, version 11.11.11, name shaped like an internal 'amdocs' scope), consistent with a dependency-confusion payload targeting an internal namespace. Installing the package causes the installer's host identifier to leave the machine to an attacker-controlled collaborator domain.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/b6f5996c483422e158520d25748f1fc5177c06a9/osv/malicious/npm/amdocs-core-package/MAL-2025-6695.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/b6f5996c483422e158520d25748f1fc5177c06a9/osv/malicious/npm/amdocs-core-package/MAL-2025-6695.json
- https://www.npmjs.com/package/amdocs-core-package/v/11.11.11
- https://github.com/advisories/GHSA-74cw-xf4j-82c6

Compromised versions (1)

= 11.11.11

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.