{"items":[{"id":"NVI-00009962","kind":"supply_chain_event","title":"Malicious code in pay-methods-kmf (npm)","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-7644-gqv2-mhcv"],"plain_summary":"GitHub lists this malware advisory for pay-methods-kmf, pay-methods-kmf, pay-methods-kmf. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-a57baee2fd3011f6ba64a851fb51d166"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-a57baee2fd3011f6ba64a851fb51d166","url":"https://github.com/advisories/GHSA-7644-gqv2-mhcv","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-7644-gqv2-mhcv","publisher":"GitHub Advisory Database","observed_at":"2026-10-31T22:07:01.069Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-a57baee2fd3011f6ba64a851fb51d166"],"technology":"pay-methods-kmf","known_exclusions":[],"conditions_summary":"## Source: amazon-inspector (07a616a1db0408a0570000c6514224d22e71c3ecee0f08268b5dd9bc96761fd2)\npay-methods-kmf@100.100.102 is a trivial stub (empty index.js, manifest description 'Frontend utilities') that ships a prebuilt Linux x64 native addon at prebuilds/linux-x64/addon.node and loads it from postinstall.js via require('./prebuilds/linux-x64/addon.node'). On install the postinstall path performs two concurrent exfiltration channels: (1) a DNS beacon that resolves a subdomain of the form ..db4jlbku53082dmp0d7g3mffj7s7aordk.oast.me against an interactsh/OAST collector, encoding the installer hostname and package name into the DNS label; and (2) the native addon calls gethostname, getpwuid, and getenv and issues an HTTP POST to the hardcoded bare IPv4 endpoint http://64.181.165.115/dc with body shape 'h=&u=&p=&r=', leaking the installer's hostname, username, package name, and configured npm registry URL (which may reveal internal/private registry hosts). The package ships no source for the binary, the compiled addon's symbol set (socket/connect/send/fork) is unrelated to any frontend utility, and both the OAST su","public_affected_ranges":["= 100.100.102"]},{"certainty":"source_listed","source_ids":["sr-a57baee2fd3011f6ba64a851fb51d166"],"technology":"pay-methods-kmf","known_exclusions":[],"conditions_summary":"## Source: amazon-inspector (07a616a1db0408a0570000c6514224d22e71c3ecee0f08268b5dd9bc96761fd2)\npay-methods-kmf@100.100.102 is a trivial stub (empty index.js, manifest description 'Frontend utilities') that ships a prebuilt Linux x64 native addon at prebuilds/linux-x64/addon.node and loads it from postinstall.js via require('./prebuilds/linux-x64/addon.node'). On install the postinstall path performs two concurrent exfiltration channels: (1) a DNS beacon that resolves a subdomain of the form ..db4jlbku53082dmp0d7g3mffj7s7aordk.oast.me against an interactsh/OAST collector, encoding the installer hostname and package name into the DNS label; and (2) the native addon calls gethostname, getpwuid, and getenv and issues an HTTP POST to the hardcoded bare IPv4 endpoint http://64.181.165.115/dc with body shape 'h=&u=&p=&r=', leaking the installer's hostname, username, package name, and configured npm registry URL (which may reveal internal/private registry hosts). The package ships no source for the binary, the compiled addon's symbol set (socket/connect/send/fork) is unrelated to any frontend utility, and both the OAST su","public_affected_ranges":["= 100.100.100"]},{"certainty":"source_listed","source_ids":["sr-a57baee2fd3011f6ba64a851fb51d166"],"technology":"pay-methods-kmf","known_exclusions":[],"conditions_summary":"## Source: amazon-inspector (07a616a1db0408a0570000c6514224d22e71c3ecee0f08268b5dd9bc96761fd2)\npay-methods-kmf@100.100.102 is a trivial stub (empty index.js, manifest description 'Frontend utilities') that ships a prebuilt Linux x64 native addon at prebuilds/linux-x64/addon.node and loads it from postinstall.js via require('./prebuilds/linux-x64/addon.node'). On install the postinstall path performs two concurrent exfiltration channels: (1) a DNS beacon that resolves a subdomain of the form ..db4jlbku53082dmp0d7g3mffj7s7aordk.oast.me against an interactsh/OAST collector, encoding the installer hostname and package name into the DNS label; and (2) the native addon calls gethostname, getpwuid, and getenv and issues an HTTP POST to the hardcoded bare IPv4 endpoint http://64.181.165.115/dc with body shape 'h=&u=&p=&r=', leaking the installer's hostname, username, package name, and configured npm registry URL (which may reveal internal/private registry hosts). The package ships no source for the binary, the compiled addon's symbol set (socket/connect/send/fork) is unrelated to any frontend utility, and both the OAST su","public_affected_ranges":["= 100.100.101"]}],"null_published_at":"2026-10-31T22:13:44.196Z","source_updated_at":"2026-10-11T15:31:15.000Z","source_disclosed_at":"2026-10-11T15:31:12.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-10-31T22:07:01.069Z"}],"next_cursor":null,"snapshot_revision":"42594"}