{"id":"MAL-2026-16216","summary":"Malicious code in tetomood (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (6c09686feb7c38e815ef9a615a6ceba2444029a34ea9d6bee8598a76bc8e8f92)\npackage.json declares both preinstall and postinstall scripts that invoke wget to POST the installer's current working directory ($(pwd)) and machine hostname ($(hostname)) to a hardcoded Discord webhook endpoint on discord.com at install time. The tarball ships only package.json (611 bytes); the declared main entry index.js is absent, so the package has no legitimate functionality — the lifecycle beacons are its sole purpose. Installing the package causes automatic host reconnaissance data to be sent to an author-controlled remote endpoint without consent.\n","modified":"2026-09-16T07:00:07.504844988Z","published":"2026-09-16T06:35:38Z","database_specific":{"malicious-packages-origins":[{"source":"amazon-inspector","versions":["12.0.0"],"id":"IN-MAL-2026-020086","import_time":"2026-09-16T06:56:08.843090937Z","modified_time":"2026-09-16T06:35:38Z","sha256":"6c09686feb7c38e815ef9a615a6ceba2444029a34ea9d6bee8598a76bc8e8f92"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/tetomood/v/12.0.0"}],"affected":[{"package":{"name":"tetomood","ecosystem":"npm","purl":"pkg:npm/tetomood"},"versions":["12.0.0"],"database_specific":{"cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}],"indicators":{"evidence_files":[{"path":"package.json","sha256":"6dd2fe7c4dc3b92baca6b52f1cf89fff5b3211862346a9c12ff668cb504595dd","tlsh":"1cf0acf25d10e572bbcb0ea63ad29a4a7aa39d4f1881163cd1034b0c03ce36f10b1a46"}],"package_integrity":[{"filename":"tetomood-12.0.0.tgz","hashes":{"sha1":"5cd6977336999b4253f6f41b7acf3a7219d3f70a","sha512_sri":"sha512-Xj2Hkfw/BbWGGloD+hhQF25xzK2lK/a+BFzrV6+Fd3RnIkng927oY5dyV2y3jUJjkEYnNmF5Y3yi/MofMSGIcg=="}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/tetomood/MAL-2026-16216.json"}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}