{"id":"MAL-2026-15923","summary":"Malicious code in line-through (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (f080fb3d5e59c5c950dd4dd0c2eb1841cdc2943e1543bd7803f7ca27d1756e60)\nThe package's package.json preinstall hook runs vishu.js, which at npm install time collects the installer's public IP (via api.ipify.org), OS hostname, and GitHub Actions / CI environment variables (CI, GITHUB_ACTIONS, GITHUB_WORKFLOW, GITHUB_RUN_ID, and related identifiers), then sends them as query parameters in an HTTPS GET to a hardcoded collector at https://webhook.site/66059630-2030-4b44-b2df-d37e02be0a7d. It also performs a DNS lookup encoding the hostname as a subdomain of an out-of-band collaborator domain (left as the placeholder your-collab-domain.oastify.com). Behavior fires automatically on npm install with no user interaction.\n","modified":"2026-09-04T07:00:09.068475741Z","published":"2026-09-04T06:33:49Z","database_specific":{"malicious-packages-origins":[{"sha256":"f080fb3d5e59c5c950dd4dd0c2eb1841cdc2943e1543bd7803f7ca27d1756e60","source":"amazon-inspector","versions":["1.0.0"],"id":"IN-MAL-2026-019633","import_time":"2026-09-04T06:53:31.164896492Z","modified_time":"2026-09-04T06:33:49Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/line-through/v/1.0.0"}],"affected":[{"package":{"name":"line-through","ecosystem":"npm","purl":"pkg:npm/line-through"},"versions":["1.0.0"],"database_specific":{"indicators":{"evidence_files":[{"tlsh":"f631414cb2f7962008f2a3c9562b941e716be1533325dd917d9c42661faad3c82e3bdc","path":"vishu.js","sha256":"10c8b1a04a5b2d2633e5467a0261b1e3ed0d9dfcab18872866c462b4e5887b51"}],"package_integrity":[{"hashes":{"sha1":"11945faa122478c539ae4076acaf9f1d252767d8","sha512_sri":"sha512-Zft23TPi1SzwjroQEV1EWBHsIjDUCbuOEDLB9MvCbQ/qnItN5lvi+meEktS6W3acaluCLHQpaGshEH96d9rdnQ=="},"filename":"line-through-1.0.0.tgz"}]},"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/line-through/MAL-2026-15923.json"}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}