{"id":"MAL-2026-16205","summary":"Malicious code in @prime0/inimatch (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (d094698410f0146ad3f51ff8860d657ca28b5f55b77ef9593b637b956996180f)\n@prime0/inimatch is a typosquat of minimatch that behaves as a stealth remote-access agent. postinstall.js runs on npm install and POSTs a host fingerprint (hostname, username, platform/arch, cwd, node version, pid, non-internal IPs, uptime, package name) to http://69.48.229.140:8080/b. index.js, on require(), beacons the same fingerprint to /b and then every 30 seconds polls http://69.48.229.140:8080/c?id=... for a JSON command, passes the returned command string to child_process.exec, and POSTs stdout/stderr back to /r, giving the operator of that host arbitrary shell execution on the installer's machine. A source comment self-identifies the package as a stealth-agent typosquat, while package.json advertises only a 'small utility'.\n","modified":"2026-09-16T06:45:06.630422803Z","published":"2026-09-16T06:27:42Z","database_specific":{"malicious-packages-origins":[{"modified_time":"2026-09-16T06:27:42Z","sha256":"d094698410f0146ad3f51ff8860d657ca28b5f55b77ef9593b637b956996180f","source":"amazon-inspector","versions":["1.0.0"],"id":"IN-MAL-2026-020074","import_time":"2026-09-16T06:31:14.550585151Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@prime0/inimatch/v/1.0.0"}],"affected":[{"package":{"name":"@prime0/inimatch","ecosystem":"npm","purl":"pkg:npm/%40prime0/inimatch"},"versions":["1.0.0"],"database_specific":{"indicators":{"evidence_files":[{"tlsh":"ff4142eb91952124a17371f4ca5f64082bbad16202439e98bc2ce385af7493c072adfc","path":"index.js","sha256":"a7fc4e3167420ca41e89f929a9721a63761e20c83b555338d91580d46e3dd3f1"},{"path":"postinstall.js","sha256":"f96920db8aa0d72723e7eab7dc5319f4395a201f8eba307b4f81974730c1d75c","tlsh":"571165e00191a6293222a1f1ca5f150917e9e4101201fe98f83cd285bff4e7c07f69ec"}],"package_integrity":[{"filename":"inimatch-1.0.0.tgz","hashes":{"sha1":"59a8e88dfe0733f425312f47d8ee3add38aaae87","sha512_sri":"sha512-3NBiobww3R3uflrXIFMFGOOxHDOQCKBJMSjqIltr5tS/PajOuzHNZ1QDzpdzMRITBaA0OCkF8A0MaohVgtDTVg=="}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@prime0/inimatch/MAL-2026-16205.json","cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}]}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}