{"id":"MAL-2026-13742","summary":"Malicious code in zeal-rq-hooks (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (dcf7e926ec85f72f362263a19d4f99c4b215ddd94ed4454c669c3387cacee164)\nThe package includes canary.js which imports os/http/https and, at line 123, POSTs a JSON body containing os.hostname(), os.userInfo(), process.platform, node/npm version, and cwd to the hardcoded endpoint https://npm-canary.aveliscare.com. The hostname is not associated with the npm registry or a documented publisher and is embedded directly in the package's own shipped code. The collected fields (hostname, username, platform, cwd) are host-identifying reconnaissance data, and the network destination is not user-configurable in the flagged code path.\n","modified":"2026-08-11T17:30:12.103609291Z","published":"2026-08-11T17:22:07Z","database_specific":{"malicious-packages-origins":[{"import_time":"2026-08-11T17:24:19.528788019Z","modified_time":"2026-08-11T17:22:07Z","sha256":"dcf7e926ec85f72f362263a19d4f99c4b215ddd94ed4454c669c3387cacee164","source":"amazon-inspector","versions":["0.0.0"],"id":"IN-MAL-2026-017374"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/zeal-rq-hooks/v/0.0.0"}],"affected":[{"package":{"name":"zeal-rq-hooks","ecosystem":"npm","purl":"pkg:npm/zeal-rq-hooks"},"versions":["0.0.0"],"database_specific":{"indicators":{"package_integrity":[{"hashes":{"sha1":"ce5a93755c893ec85f8160daf5992369b4e0154b","sha512_sri":"sha512-W7k44IcqJxuqqQA3Y0DTWO8eAeVVfQRu36cM6dYy1qbXmthEjAgToGboUZqxFpMEWWgihEoLrcA8KfuiSoxEmw=="},"filename":"zeal-rq-hooks-0.0.0.tgz"}],"evidence_files":[{"tlsh":"acd1d86613f052762b8206b4591f00979736e027722aa170f5af92143f4a6bc87f3deb","path":"canary.js","sha256":"313f6afebeb44640d7df7a1995d0958bed918ecf2be8f171d4fbfe8dcab91f1d"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/zeal-rq-hooks/MAL-2026-13742.json","cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}]}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}