{"id":"MAL-2026-13460","summary":"Malicious code in stretchshop (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (479c1238e6380db5463eb3755b980f963d269b2b0874d464b9e1b3b65bd03f60)\npackage.json declares a postinstall hook that runs `node demo/demo.js base`, which shell-invokes `git clone https://github.com/Wradgio/StretchShop-demo-data.git` at mutable HEAD (no commit SHA, no tag, no integrity check) and then `childProcess.fork`s `db/demo_data.js` from the freshly cloned tree. The cloned repository is owned by the personal GitHub account `Wradgio`, which does not match the package's publisher scope `StretchShop`. Whoever controls that GitHub account can push arbitrary JavaScript to the default branch and have it executed on every fresh top-level install of stretchshop@0.7.5.\n","modified":"2026-08-06T23:50:22.619239336Z","published":"2026-08-06T15:34:27Z","database_specific":{"malicious-packages-origins":[{"source":"amazon-inspector","versions":["0.7.5"],"id":"IN-MAL-2026-016653","import_time":"2026-08-06T18:09:01.76413629Z","modified_time":"2026-08-06T15:34:27Z","sha256":"479c1238e6380db5463eb3755b980f963d269b2b0874d464b9e1b3b65bd03f60"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/stretchshop/v/0.7.5"}],"affected":[{"package":{"name":"stretchshop","ecosystem":"npm","purl":"pkg:npm/stretchshop"},"versions":["0.7.5"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"package_integrity":[{"filename":"stretchshop-0.7.5.tgz","hashes":{"sha512_sri":"sha512-2314vzjdcvwgVJa3KyxcmHcVuMpthLLN6EA4dQN/4wTvga9szP9w/YnisjR3k1ehujp/Z9ZXjsS0xSeC7mc3bA==","sha1":"c13ad6b55e44ff8862790baa43fd06c38b764236"}}],"evidence_files":[{"path":"demo/demo.js","sha256":"f9d9f5c071ef5a76e0e379db50a96b4c5fc5511c639912d09175317d87c19f9a","tlsh":"e69176435bcc072475e42657bc16099b11ed82b1e8b07d1898ddc9f631a78ec664eeb2"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/stretchshop/MAL-2026-13460.json"}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}