{"id":"MAL-2026-11192","summary":"Malicious code in test2221 (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (f6113dcb20ef051691e0cc0034132b94421604bd16a085229f75aae5c612a3d9)\npackage.json declares preinstall and postinstall lifecycle scripts that run curl against http://54.37.234.136/voicemail over plain HTTP, sending the installer's username (whoami), hostname, working directory, and a timestamp as query-string parameters. Both hooks fire automatically on `npm install`, transmitting installer host identifiers to a hardcoded bare-IP endpoint with no relation to any documented package purpose. The behavior matches reconnaissance-beacon shape suitable for follow-on targeting of the installer's host.\n\n## Source: ossf-package-analysis (178c9841a69c4a2de3ad248f8d4dbba8f004c8e8947a34f9e6ae12404183e6e2)\nThe OpenSSF Package Analysis project identified 'test2221' @ 2.2.4 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package executes one or more commands associated with malicious behavior.\n","modified":"2026-08-05T14:37:25.173482405Z","published":"2026-07-29T06:55:50Z","database_specific":{"malicious-packages-origins":[{"source":"ossf-package-analysis","versions":["2.2.4"],"import_time":"2026-07-30T05:59:06.389847784Z","modified_time":"2026-07-29T06:55:50Z","sha256":"178c9841a69c4a2de3ad248f8d4dbba8f004c8e8947a34f9e6ae12404183e6e2"},{"versions":["2.2.4"],"id":"IN-MAL-2026-011087","import_time":"2026-08-04T21:33:16.370042403Z","modified_time":"2026-08-04T21:30:39Z","sha256":"38741fd8a6f3ffcff6a34fbe07df84f5694996ca108b575078937d43906353d2","source":"amazon-inspector"},{"modified_time":"2026-08-05T13:14:58Z","sha256":"310867cf8d300cc2e3c9b9744cd9c4eb7df1b6ff855ee38e108e793fe556cbef","source":"amazon-inspector","versions":["2.2.3"],"id":"IN-MAL-2026-014942","import_time":"2026-08-05T14:19:45.193681567Z"},{"id":"IN-MAL-2026-014934","import_time":"2026-08-05T14:19:44.410850907Z","modified_time":"2026-08-05T13:13:49Z","sha256":"f6113dcb20ef051691e0cc0034132b94421604bd16a085229f75aae5c612a3d9","source":"amazon-inspector","versions":["2.2.6"]}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/test2221/v/2.2.4"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/test2221/v/2.2.3"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/test2221/v/2.2.6"}],"affected":[{"package":{"name":"test2221","ecosystem":"npm","purl":"pkg:npm/test2221"},"versions":["2.2.4","2.2.3","2.2.6"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/test2221/MAL-2026-11192.json","indicators":{"evidence_files":[{"tlsh":"16e02b6c983979733ac0831c2c59c30a79855fbb1154ac0a6b435d0d1ddd27aa07b36b","path":"package.json","sha256":"cbb1f7c1220c8e0bcf026e40b7769ce781b6bbc64f2c4a1dd4bc4f635e507e8e"}],"package_integrity":[{"hashes":{"sha1":"2f571c70a932ca92590a04707c66466a6b8de215","sha512_sri":"sha512-HYGrh2sipjuoggF9za3Me1+s85fIR1stwNf1+FGr2Vj934LBcxg54+gpoQyMIO74epdc9Vme0OucKw1YY22Vyw=="},"filename":"test2221-2.2.4.tgz"}]},"cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}]}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"OpenSSF: Package Analysis","contact":["https://github.com/ossf/package-analysis","https://openssf.slack.com/channels/package_analysis"],"type":"FINDER"}]}