{"id":"MAL-2026-14016","summary":"Malicious code in preinstall-hook-webhook-callback-demo (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (d6e707d55368c2628038e0efaac35629fba6dbd520e66a7e29f9c6a86c69b2e1)\npackage.json declares a preinstall lifecycle script that contacts webhook.site, an ephemeral request-capture service commonly used as an attacker-controlled exfiltration sink. The hook fires automatically on `npm install` before any user interaction, and webhook.site is not a first-party or documented destination for any legitimate build or runtime purpose of this package. The combination of an auto-executing preinstall script wired to an out-of-band capture endpoint is the shape of installer-side data exfiltration / callback beaconing at install time.\n","modified":"2026-08-13T22:30:12.558362478Z","published":"2026-08-13T21:54:42Z","database_specific":{"malicious-packages-origins":[{"sha256":"037c89bf149ea8deefcf9cba562b080ad8046120e0b9f722a66b61af58c2f4ef","source":"amazon-inspector","versions":["1.0.1"],"id":"IN-MAL-2026-017712","import_time":"2026-08-13T22:20:21.59739106Z","modified_time":"2026-08-13T21:54:55Z"},{"import_time":"2026-08-13T22:20:21.500983972Z","modified_time":"2026-08-13T21:54:42Z","sha256":"d6e707d55368c2628038e0efaac35629fba6dbd520e66a7e29f9c6a86c69b2e1","source":"amazon-inspector","versions":["1.0.0"],"id":"IN-MAL-2026-017711"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/preinstall-hook-webhook-callback-demo/v/1.0.1"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/preinstall-hook-webhook-callback-demo/v/1.0.0"}],"affected":[{"package":{"name":"preinstall-hook-webhook-callback-demo","ecosystem":"npm","purl":"pkg:npm/preinstall-hook-webhook-callback-demo"},"versions":["1.0.1","1.0.0"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/preinstall-hook-webhook-callback-demo/MAL-2026-14016.json","cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"},{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}],"indicators":{"package_integrity":[{"hashes":{"sha1":"16188ac17c7f5c51f20ebc99a2893f521f94fe26","sha512_sri":"sha512-SehacCDUJu+kGoZm4vn9Y0nws861XTISgJ8IOvbSQJ5ey03kRB7PBqdbHJysUK//KnpQryDHMMClmMNL/4Y8Kg=="},"filename":"preinstall-hook-webhook-callback-demo-1.0.1.tgz"}],"evidence_files":[{"path":"package.json","sha256":"44457e693878895b1248648ee589ad6cb57f43d29f8fad37a95d66b588a02751","tlsh":"e8017b38ca12a93128d49bf50a17414712a1882b4a603d49b7cb417d8f5f61f44bf31f"}]}}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}