{"id":"MAL-2026-12788","summary":"Malicious code in editor_application (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (c5914405fc5126f1abcc621e835b7e71774fb1b49cc51d5f02e808292769eb25)\npackage.json declares a preinstall hook that runs `node callback.js`, which on `npm install` collects host-level identifiers (os.hostname, os.userInfo username, current working directory, npm_config_registry) and private CI repository slugs from a broad set of provider env vars (GITHUB_REPOSITORY, GitLab, Azure, Bitbucket, Travis, Drone, Buildkite, Circle, Jenkins) and transmits them via plain-HTTP GET to http://75.119.137.232:31337/depconfuse as query parameters (pkg, h, u, d, reg, ci). The version number 9999.0.0 combined with the `/depconfuse` path is the signature of a dependency-confusion beacon that maps internal package namespaces and CI topology of installing organizations to a hardcoded attacker-controlled bare-IP endpoint.\n","modified":"2026-08-05T14:37:12.186589268Z","published":"2026-08-05T13:17:36Z","database_specific":{"malicious-packages-origins":[{"versions":["9999.0.0"],"id":"IN-MAL-2026-014960","import_time":"2026-08-05T14:19:47.00495852Z","modified_time":"2026-08-05T13:17:36Z","sha256":"c5914405fc5126f1abcc621e835b7e71774fb1b49cc51d5f02e808292769eb25","source":"amazon-inspector"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/editor_application/v/9999.0.0"}],"affected":[{"package":{"name":"editor_application","ecosystem":"npm","purl":"pkg:npm/editor_application"},"versions":["9999.0.0"],"database_specific":{"cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}],"indicators":{"evidence_files":[{"sha256":"00b7cf6378da166a1054ad9895f53e9937dd3d53e086c01e2f2b3063b31c99ee","tlsh":"2a117bb9c68c0c3409c21784b9686c5eb8fbd29233c294917f2d71d26bb227046b71f9","path":"callback.js"}],"package_integrity":[{"filename":"editor_application-9999.0.0.tgz","hashes":{"sha1":"3fa84fd6e6fd73fa694cc2d42f0931e3307b1ca1","sha512_sri":"sha512-nqi8yifEMO5SrRi6Ozgp8pxeo8w1lrC6WElMWnzADKLi2EeDVP/OoMT6cv8xlQF90PsY9tBMxviTmdL9Qmr1Lw=="}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/editor_application/MAL-2026-12788.json"}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}