{"id":"MAL-2026-15524","summary":"Malicious code in tabbables (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (2fc629ecaf81d15034bbba33363e63776d106e6f58932e889baa4cb748b689eb)\npackage.json at line 11 declares a dependency whose key equals the package's own name (`tabbables`) and whose value is the raw HTTPS URL `https://repo.securityctrl.com/tabbables` rather than a registry version range. On `npm install`, npm fetches whatever tarball that URL currently serves and installs it, executing any lifecycle scripts it contains, with no version pin, no integrity/hash check, and no registry provenance. The shipped index.js is an inert stub, so the manifest URL is the sole payload-delivery mechanism; the tarball's behavior can be changed at any time by whoever controls repo.securityctrl.com. The self-referential dependency key also produces a dependency-confusion shape (an implausibly high 45.0.0 version competing with any internal package of the same name).\n","modified":"2026-08-28T23:31:36.967239719Z","published":"2026-08-28T23:13:26Z","database_specific":{"malicious-packages-origins":[{"sha256":"2fc629ecaf81d15034bbba33363e63776d106e6f58932e889baa4cb748b689eb","source":"amazon-inspector","versions":["45.0.0"],"id":"IN-MAL-2026-019081","import_time":"2026-08-28T23:14:36.933080216Z","modified_time":"2026-08-28T23:13:26Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/tabbables/v/45.0.0"}],"affected":[{"package":{"name":"tabbables","ecosystem":"npm","purl":"pkg:npm/tabbables"},"versions":["45.0.0"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/tabbables/MAL-2026-15524.json","indicators":{"evidence_files":[{"tlsh":"dee0c22649112a3746c6a5624879c45773226f6f04047c19e2cb441c824d5b768fb79c","path":"package.json","sha256":"05a677d0267255faf3ee8de887da3845e89ef4148caf4620a188dbe7e9b279b6"}],"package_integrity":[{"filename":"tabbables-45.0.0.tgz","hashes":{"sha1":"5c0c6b11781f926494cae48e4c6526ee7ff34cff","sha512_sri":"sha512-gaQgowmQd5bLG5OW65trNAjidu2TSftYfgmkgvnA+Ln+CXKeHZURXx5qbNvGR+nnor5XJInhmZ+D11tIszSgqg=="}}]},"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}]}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}