{"id":"MAL-2026-13951","summary":"Malicious code in functions-framework-nodejs (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (d4c9e327ae7e806fc6d270807180963349c0b7578b69f31336780d87323fdafa)\nPackage `functions-framework-nodejs` is a typosquat of Google's `@google-cloud/functions-framework`. Its package.json declares `postinstall: node install.js`, and install.js runs `execSync(\"id\")` on the installer's host, then POSTs the captured Unix user/group identity (with package name, version, and timestamp) to a hardcoded webhook.site collector URL. The advertised library surface (index.js) is a trivial stub exporting only name and version — the package's sole functional effect on install is the identity exfiltration. Package metadata self-labels as \"For Security Research\" by author \"Berserk\"; that label does not change the behavior: on `npm install`, installer-side host identity is sent to a third-party endpoint the installer did not configure.\n","modified":"2026-08-13T17:30:11.192474033Z","published":"2026-08-13T17:21:06Z","database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-017653","import_time":"2026-08-13T17:24:46.078743903Z","modified_time":"2026-08-13T17:21:06Z","sha256":"d4c9e327ae7e806fc6d270807180963349c0b7578b69f31336780d87323fdafa","source":"amazon-inspector","versions":["1.0.0"]}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/functions-framework-nodejs/v/1.0.0"}],"affected":[{"package":{"name":"functions-framework-nodejs","ecosystem":"npm","purl":"pkg:npm/functions-framework-nodejs"},"versions":["1.0.0"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/functions-framework-nodejs/MAL-2026-13951.json","cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}],"indicators":{"evidence_files":[{"tlsh":"171102ae55f02b3061f5e4d0b4668844a4e3d213f50dbcd475cd07641f8d8e910727ee","path":"install.js","sha256":"30d96bfb7b69b8df81e6fca2165f27b2fb6d1a99a056be6a0fc0e43e301c6381"},{"sha256":"2aafc6045d7cbb6ca1d5d936275cd0c7479f9978c343668514f9013cfd73a47e","tlsh":"81d0a7181c25aa3368c05eb50927910a76b19d5b1054fc0c27a7119893efbfa44bf75f","path":"package.json"}],"package_integrity":[{"filename":"functions-framework-nodejs-1.0.0.tgz","hashes":{"sha1":"d3b39874019dc0cfb6c0177eb2de1cb1ceb9bb90","sha512_sri":"sha512-8K8HPfLucxSnyys79CWgvKR9izwZaoIkukKN2yZIT5boF+iFlVCcXUTom6/u3DhvOelOkpuOJbhxIdWVkSlc1A=="}}]}}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}