{"id":"MAL-2026-12136","summary":"Malicious code in accounts-stores (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (c70d8323b295e6b8dfa18e720a7b6e2a719c42d19a5dedab1157866043417c7d)\nThe package advertises itself as a reactive state-management library but its index.js silently requires./setup at the end of module load inside a try/catch. setup.js schedules a next-tick bootstrap that collects a host fingerprint (os.hostname(), os.userInfo().username, process.cwd(), pid, platform, arch), derives an installId, and loads a ~76KB lib/telemetry.js runtime that POSTs data via https.request. The identifier reads are obfuscated via string-concatenation indirection (os[\"host\"+\"name\"](), os[\"user\"+\"Info\"](), os[\"plat\"+\"form\"](), and a helper const _p=(k)=\u003eos[k]()), which is not consistent with legitimate telemetry SDKs. The destination host is not present as a plain literal in telemetry.js; the file imports dns and https and contains a ServiceDiscovery class that resolves the endpoint at runtime, hiding the exfiltration target from source inspection. Nothing in the advertised state-store API references telemetry, and no opt-in or configuration surface is exposed.\n","modified":"2026-08-05T10:05:46.206407895Z","published":"2026-08-05T09:08:53Z","database_specific":{"malicious-packages-origins":[{"modified_time":"2026-08-05T09:08:53Z","sha256":"c70d8323b295e6b8dfa18e720a7b6e2a719c42d19a5dedab1157866043417c7d","source":"amazon-inspector","versions":["0.0.1"],"id":"IN-MAL-2026-014565","import_time":"2026-08-05T09:28:26.114996744Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/accounts-stores/v/0.0.1"}],"affected":[{"package":{"name":"accounts-stores","ecosystem":"npm","purl":"pkg:npm/accounts-stores"},"versions":["0.0.1"],"database_specific":{"indicators":{"package_integrity":[{"filename":"accounts-stores-0.0.1.tgz","hashes":{"sha512_sri":"sha512-7jdabfKv77/KnuqQAQt43UHzKUgGzHGAc3hpELZgk6FjaGHpj9xzn9wP6s6JG09dYSoDp5R1oQHhq32BEinI9w==","sha1":"dba11c804cf2e65380631db3f2dc60a390d1ec51"}}],"evidence_files":[{"sha256":"48a5b511b15cae43853d652f9c988e50d654ff2cbe1476011064098d7a642906","tlsh":"9b01475237aa696f8474a3a39e3d4167f88bc43505801298b38881dc1fa8c14449dcbc","path":"index.js"},{"tlsh":"1361115c6ed135260194e3f92a6f804bc99245432ac8ba58be4fb3451f5413983bff6f","path":"setup.js","sha256":"56f1fc5a6fce6c48eb1b34a89a8e7d64d8540584f53f22c0977acaeaa3ac71b6"},{"tlsh":"6f735055526a642186b2b368df334107ff3685272603429dbafc82dc1fb972092a5ffd","path":"lib/telemetry.js","sha256":"eac4233f664fa380839d8492bf8f5b9e2eaf89969a29ebb2572f880df62ce553"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/accounts-stores/MAL-2026-12136.json","cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}]}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}