{"id":"MAL-2026-12435","summary":"Malicious code in sc-geeksquad-core (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (2fd2458d8a5843f57187868a2c244a376dd3d2daef420d3c564c775ef6a2782a)\nsc-geeksquad-core@9999.0.0 declares a preinstall script `node callback.js` that runs automatically on `npm install`. The script collects the installer's hostname (`os.hostname()`), OS username (`os.userInfo().username`), current working directory (`process.cwd()`), configured npm registry (`npm_config_registry`), and a set of CI repository-slug environment variables (GITHUB_REPOSITORY, CI_PROJECT_PATH, BUILD_REPOSITORY_NAME, BITBUCKET_REPO_FULL_NAME, TRAVIS_REPO_SLUG, DRONE_REPO, BUILDKITE_PIPELINE_SLUG, CIRCLE_PROJECT_REPONAME, JOB_NAME), then sends them via HTTP GET to the hardcoded bare-IP endpoint `http://75.119.137.232:31337/depconfuse` as query parameters. The placeholder version `9999.0.0` combined with a generic scoped-sounding name is the canonical dependency-confusion reconnaissance shape: the package is published to public npm to intercept internal-package name resolution and beacon back which private-namespace builds are vulnerable to substitution.\n","modified":"2026-08-05T13:35:54.841354675Z","published":"2026-08-05T13:07:29Z","database_specific":{"malicious-packages-origins":[{"sha256":"2fd2458d8a5843f57187868a2c244a376dd3d2daef420d3c564c775ef6a2782a","source":"amazon-inspector","versions":["9999.0.0"],"id":"IN-MAL-2026-014891","import_time":"2026-08-05T13:08:53.322400325Z","modified_time":"2026-08-05T13:07:29Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/sc-geeksquad-core/v/9999.0.0"}],"affected":[{"package":{"name":"sc-geeksquad-core","ecosystem":"npm","purl":"pkg:npm/sc-geeksquad-core"},"versions":["9999.0.0"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/sc-geeksquad-core/MAL-2026-12435.json","cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}],"indicators":{"evidence_files":[{"path":"callback.js","sha256":"34b0456abf5f832f3a75addcda3dc765fe77a0929196a9d4e754393fa0fe0af5","tlsh":"2b117bb9c68c0c3409c21780796c6c5eb8fbd29233c294917f2d71d26bb22b046b75b9"}],"package_integrity":[{"filename":"sc-geeksquad-core-9999.0.0.tgz","hashes":{"sha1":"2ba8e9b9308db1c083f88cf80285178f26e11490","sha512_sri":"sha512-upAoB93tviS4WRPiZVsgfejdOz9cBNsioQ2jEsYt3mWJaxmVOaxHCkxj7srGOJbYCiRBIDm1O7WxkJttGA/z/g=="}}]}}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}