{"id":"MAL-2026-12353","summary":"Malicious code in clover-codelab-remote-pay-cloud (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (071fbdd6b5ca7cbb0fc696f5abf7a47be3783dd970ca5594cb415e67579f2b15)\nThe package declares a postinstall hook that runs index.js on npm install. index.js collects the OS username, current working directory, hostname, and non-internal IPv4 address via os.userInfo(), process.cwd(), os.hostname(), and os.networkInterfaces(), then POSTs the values as JSON over https to a hardcoded webhook.site collector at https://webhook.site/9aa13631-fbb0-4b6b-a256-27d1672f767c. The package name resembles Clover's remote-pay-cloud SDK and the version is set to 99.9.9, a dependency-confusion shape intended to override an internal package during resolution. The package provides no functionality matching its name — its only install-time effect is the exfiltration beacon.\n","modified":"2026-09-01T11:31:32.039747264Z","published":"2026-08-05T13:03:41Z","database_specific":{"malicious-packages-origins":[{"versions":["99.9.9"],"id":"IN-MAL-2026-014866","import_time":"2026-08-05T13:08:51.926328928Z","modified_time":"2026-08-05T13:03:41Z","sha256":"071fbdd6b5ca7cbb0fc696f5abf7a47be3783dd970ca5594cb415e67579f2b15","source":"amazon-inspector"},{"id":"RLMA-2026-06156","import_time":"2026-09-01T11:17:29.245074242Z","modified_time":"2026-08-24T16:44:43Z","sha256":"85ce05e7b3af948c7a709a140dfa44a9fef7f783f09e99fd2772cf409737ad75","source":"reversing-labs","versions":["99.9.9"]}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/clover-codelab-remote-pay-cloud/v/99.9.9"}],"affected":[{"package":{"name":"clover-codelab-remote-pay-cloud","ecosystem":"npm","purl":"pkg:npm/clover-codelab-remote-pay-cloud"},"versions":["99.9.9"],"database_specific":{"indicators":{"evidence_files":[{"path":"index.js","sha256":"3a420426ad447e86c9aa21cf4a388e2f172e57653206bc3a015d7ed469283e2b","tlsh":"4c01bdf584f3a1201ea575d18c4eec0da262d003780a79d07e5c83659fc9afc19b1bec"}],"package_integrity":[{"filename":"clover-codelab-remote-pay-cloud-99.9.9.tgz","hashes":{"sha512_sri":"sha512-kk29cJkFrC3QpxiHo2i8knN0dHN7TH25XnKeBrdtb3+AyYisVTNY/B0cdJcOzf9B3KF5+1z16XSbuqFb8h92eg==","sha1":"f6d100507c8e30a8ee1ff44ba8358e33a0b1ddcb"}}]},"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/clover-codelab-remote-pay-cloud/MAL-2026-12353.json"}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"ReversingLabs","contact":["https://www.reversinglabs.com"],"type":"FINDER"}]}