x509-escaping

GHSA-fq85-7xqm-cgj9

Malicious code in x509-escaping (npm)

Details

**Severity:** Critical

**Affected versions:** `= 0.0.0`

## Source: amazon-inspector (a0ac597bf732e187011fdef75554843eec3e581b18fdf2c0e83b4dd4aa559731)
package.json declares `preinstall: node index.js`, so on `npm install` the shipped index.js runs automatically. It collects hostname, username, home directory, DNS servers, and current working directory, and reads /etc/passwd and /etc/hosts via fs.readFileSync, then POSTs the bundle over HTTPS to the hardcoded host `agumuj6lhw9yqopq6npl1nlgu70yorcg.oastify.com` (a Burp Collaborator out-of-band subdomain). The package name and single-purpose recon payload match the dependency-confusion reconnaissance pattern: no library functionality is shipped, only install-time data exfiltration to an attacker-controlled OOB host.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/1eebeb2966b8d7daea8d93addcfb920fba7f6a02/osv/malicious/npm/x509-escaping/MAL-2025-889.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/1eebeb2966b8d7daea8d93addcfb920fba7f6a02/osv/malicious/npm/x509-escaping/MAL-2025-889.json
- https://www.npmjs.com/package/x509-escaping/v/1.0.1
- https://github.com/advisories/GHSA-fq85-7xqm-cgj9

Compromised versions (1)

= 0.0.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.