{"id":"MAL-2026-12478","summary":"Malicious code in test22221 (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (e4a3401759b5c6d7effdafcbae6027657e3cf8f9aabf1f04dfc2fa9039b64e53)\npackage.json declares preinstall and postinstall lifecycle hooks that run on `npm install`. Both hooks curl a hardcoded bare-IP endpoint over plain HTTP at 54.37.234.136, sending the installer's username (`whoami`), hostname, current working directory, and a timestamp as query-string parameters to `http://54.37.234.136/voicemail`. The same lifecycle scripts also embed an unbounded `for((i=1;;i++))` loop that repeatedly curls incrementing paths on the same host with a 10-second sleep, functioning as a long-poll channel to the attacker-controlled endpoint during install. The destination is a bare IP with no relationship to any package publisher domain, and the collected fields are host-identification data with no legitimate purpose in an install hook.\n","modified":"2026-08-05T13:36:17.041759627Z","published":"2026-08-05T12:44:50Z","database_specific":{"malicious-packages-origins":[{"source":"amazon-inspector","versions":["2.2.7"],"id":"IN-MAL-2026-014868","import_time":"2026-08-05T13:08:52.02623016Z","modified_time":"2026-08-05T13:03:58Z","sha256":"a44fe0c6ead0b2a6bb04d0b5e3b533495b68798d43c99f3ba0de9f7602687f66"},{"versions":["2.2.8"],"id":"IN-MAL-2026-014752","import_time":"2026-08-05T13:08:43.624852628Z","modified_time":"2026-08-05T12:46:03Z","sha256":"e3cbc7d139320187d95a6264959f8d4a2a6688fa6140bc8bc43e2fba0110914f","source":"amazon-inspector"},{"sha256":"e4a3401759b5c6d7effdafcbae6027657e3cf8f9aabf1f04dfc2fa9039b64e53","source":"amazon-inspector","versions":["2.2.9"],"id":"IN-MAL-2026-014744","import_time":"2026-08-05T13:08:42.770916845Z","modified_time":"2026-08-05T12:44:50Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/test22221/v/2.2.7"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/test22221/v/2.2.8"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/test22221/v/2.2.9"}],"affected":[{"package":{"name":"test22221","ecosystem":"npm","purl":"pkg:npm/test22221"},"versions":["2.2.7","2.2.8","2.2.9"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/test22221/MAL-2026-12478.json","indicators":{"evidence_files":[{"path":"package.json","sha256":"a0b87bbb02973582b409e66d9f3281c35567abd5c854a3a02fcab50ee48a2d9e","tlsh":"0af09e5c9825ae733bc0831c3c95c30bb5816ef79158bc1aaf030c49288c176607a36b"}],"package_integrity":[{"filename":"test22221-2.2.7.tgz","hashes":{"sha1":"41fed083fdc48702f82661043c48784d23b41200","sha512_sri":"sha512-f4gbJCquvC2lPJva9eGR33Kjg1lqr+JNUyw0l+3sHvbLMezdG+o2yxrECoOmIPTaWPQZPIRq+bW+ogYj+zXLjg=="}}]},"cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."},{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"},{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}]}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}