{"id":"MAL-2026-16006","summary":"Malicious code in vishal_312pkg (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (74d38dada8ec3921b4a3f69e7d44b5f5b54d345ff8f9581d34007a3e68679da4)\npackage.json declares a preinstall lifecycle script that runs on `npm install` and issues a wget request to https://webhook.site/ea0ca859-424d-4cc5-9210-62f7e25692a1/ carrying the installer's username ($(whoami)), current working directory ($(pwd)), and hostname ($(hostname)) as querystring parameters. The destination is a third-party request-inspection collector hardcoded in the manifest, unrelated to any documented package purpose. This is the canonical dependency-confusion / reconnaissance beacon shape: automatic execution at install time, unconditional outbound network to an attacker-controlled endpoint, and disclosure of installer host identifiers that identify internal environments and users.\n\n## Source: ossf-package-analysis (a0c8bd63b24097ddfa37be2a0c26450b21d7963a77c5bd81bc4892b89490d51b)\nThe OpenSSF Package Analysis project identified 'vishal_312pkg' @ 1.0.0 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package executes one or more commands associated with malicious behavior.\n","modified":"2026-09-08T19:30:06.192065725Z","published":"2026-09-06T12:45:40Z","database_specific":{"malicious-packages-origins":[{"versions":["1.0.0"],"import_time":"2026-09-07T05:19:18.023049553Z","modified_time":"2026-09-06T12:45:40Z","sha256":"a0c8bd63b24097ddfa37be2a0c26450b21d7963a77c5bd81bc4892b89490d51b","source":"ossf-package-analysis"},{"import_time":"2026-09-08T19:15:04.028774312Z","modified_time":"2026-09-08T19:07:47Z","sha256":"74d38dada8ec3921b4a3f69e7d44b5f5b54d345ff8f9581d34007a3e68679da4","source":"amazon-inspector","versions":["1.0.0"],"id":"IN-MAL-2026-019677"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/vishal_312pkg/v/1.0.0"}],"affected":[{"package":{"name":"vishal_312pkg","ecosystem":"npm","purl":"pkg:npm/vishal_312pkg"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"package.json","sha256":"96530907f28bf7d163b60d3fd2e32f0f488a6795290b5dd2a51399cffe1d9f2f","tlsh":"9801dd34e7207a3307c98ea00029122bbe76f7ab81062c0cfb736119d35dce114b8588"}],"package_integrity":[{"filename":"vishal_312pkg-1.0.0.tgz","hashes":{"sha512_sri":"sha512-vbIPbmdS/jDuGD53XeisF2y7gZSpXW8stR3V+RDASDXbp0JOUB8drx7wXCEnYLS1Kd3qCQnGkeo3lWW/fdzgdg==","sha1":"a05792b078fba3af2f25c7f5f7eabb3f4c60ee92"}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/vishal_312pkg/MAL-2026-16006.json"}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"OpenSSF: Package Analysis","contact":["https://github.com/ossf/package-analysis","https://openssf.slack.com/channels/package_analysis"],"type":"FINDER"}]}