0vulnerabilities
- Critical0 (0.0%)
- High0 (0.0%)
- Medium0 (0.0%)
- Moderate0 (0.0%)
- Low0 (0.0%)
identityscimapiserv
Ecosystem: npm
Downloads:
- 0CriticalAffects 0 versions
- 0HighAffects 0 versions
- 0MediumAffects 0 versions
- 0ModerateAffects 0 versions
- 0LowAffects 0 versions
Monthly breakdown
- 0 vulnerabilities
- Critical: 0
- High: 0
- Medium: 0
- Moderate: 0
- Low: 0
Vulnerabilities (1)
Known vulnerabilities affecting identityscimapiserv, based on data from OSV.
| ID | Severity | Summary | Affected versions | Published | Source |
|---|---|---|---|---|---|
| MAL-2026-11061 | Unknown | Malicious code in identityscimapiserv (npm)--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (e866098aa6115f837577cc3b24eae409fb1fb67167757f2f0c5517dfa9d8d209) The package's preinstall hook runs index.js, which collects hostname, platform, architecture, home directory, and DNS server list via the Node os module and POSTs the JSON payload over HTTPS to the hardcoded host 367qobrcgbi1dvqrghhhpvham1stgr4g.oastify.com at path /hit. The endpoint is a Burp Collaborator subdomain, an out-of-band interaction server commonly used as a dependency-confusion / reconnaissance beacon. The exfiltration fires aut |
| OSV (opens in a new tab) |
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (e866098aa6115f837577cc3b24eae409fb1fb67167757f2f0c5517dfa9d8d209) The package's preinstall hook runs index.js, which collects hostname, platform, architecture, home directory, and DNS server list via the Node os module and POSTs the JSON payload over HTTPS to the hardcoded host 367qobrcgbi1dvqrghhhpvham1stgr4g.oastify.com at path /hit. The endpoint is a Burp Collaborator subdomain, an out-of-band interaction server commonly used as a dependency-confusion / reconnaissance beacon. The exfiltration fires aut