{"id":"MAL-2026-10493","summary":"Malicious code in insomnia-plugin-poc-m4gester-run (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (38a525aea57681df6c21035b723701fa6067f091fd81ac26bb3fcc8e2126c43e)\npackage.json declares a postinstall lifecycle hook that runs `calc.exe` on the installer's machine during `npm install`. The main entry point exports only an empty `requestHooks` array, providing no actual Insomnia plugin functionality — the package's sole effect is the arbitrary command execution at install time. The name self-identifies as a proof-of-concept and mimics the Insomnia plugin naming convention with a leet-substituted variant, indicating the package exists solely to demonstrate/exploit install-time RCE. While calc.exe itself is benign, the postinstall hook establishes full arbitrary-command-execution capability against any developer installing the package on Windows.\n","modified":"2026-07-13T21:31:55.100156693Z","published":"2026-07-13T21:04:34Z","database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-010318","import_time":"2026-07-13T21:25:58.795095532Z","modified_time":"2026-07-13T21:04:34Z","sha256":"38a525aea57681df6c21035b723701fa6067f091fd81ac26bb3fcc8e2126c43e","source":"amazon-inspector","versions":["1.0.0"]}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/insomnia-plugin-poc-m4gester-run/v/1.0.0"}],"affected":[{"package":{"name":"insomnia-plugin-poc-m4gester-run","ecosystem":"npm","purl":"pkg:npm/insomnia-plugin-poc-m4gester-run"},"versions":["1.0.0"],"database_specific":{"cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}],"indicators":{"evidence_files":[{"sha256":"c2976db0b91be3b957e378fc7ba55588b8d13e125be54be40dc7d64b2f73fbc7","tlsh":"dfc08030d551653314c406c541b556435d414d170104540403d32060f6efb72189e70f","path":"package.json"}],"package_integrity":[{"hashes":{"sha1":"2ef397f337cd1c7d809e8ee1d8d841c900d45a30","sha512_sri":"sha512-2eQhPgFHXBRGQK+TX0S7Ashf2oo6kPMxI2cl+YYWs829L5twFlLMCxDSqCCLuSEhxec1VKooW8Ky2BEAMV+Kaw=="},"filename":"insomnia-plugin-poc-m4gester-run-1.0.0.tgz"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/insomnia-plugin-poc-m4gester-run/MAL-2026-10493.json"}}],"schema_version":"1.7.5","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}