{"id":"MAL-2026-16311","summary":"Malicious code in test12vv36 (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (9292921d0fe368160694717f99eca753070a4249696c72b2f1bff9594cab40be)\ntest12vv36@99.99.99 declares both preinstall and postinstall lifecycle hooks that execute index.js on npm install. index.js issues an HTTP GET to a hardcoded bare-IP endpoint at http://128.199.122.145/?test12vv36, sending the package name in the query string and disclosing the installer's source IP to the operator of that host. The version number (99.99.99) and package.json shape (dependency on a typosquat name 'requests@^0.3.0' plus a duplicate misspelled 'Dependencies' key) are consistent with a dependency-confusion or proof-of-concept publish rather than a functional library. Installing the package causes unauthenticated, unencrypted outbound network activity to attacker-controlled infrastructure at install time, confirming successful installation on the host.\n","modified":"2026-09-21T03:30:17.638894524Z","published":"2026-09-21T03:23:35Z","database_specific":{"malicious-packages-origins":[{"sha256":"9292921d0fe368160694717f99eca753070a4249696c72b2f1bff9594cab40be","source":"amazon-inspector","versions":["99.99.99"],"id":"IN-MAL-2026-020211","import_time":"2026-09-21T03:24:21.934740204Z","modified_time":"2026-09-21T03:23:35Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/test12vv36/v/99.99.99"}],"affected":[{"package":{"name":"test12vv36","ecosystem":"npm","purl":"pkg:npm/test12vv36"},"versions":["99.99.99"],"database_specific":{"indicators":{"evidence_files":[{"path":"index.js","sha256":"bc8d807a41cca39765c8272af40c02735cfd226420e8c8ab16da5227d41fbcf9","tlsh":"57c08cc25382f3848bf1088269292616230df170b9fc04b6e34c23ad488397d25a3ac1"},{"sha256":"052723013adc7fb5de8366d0af1c6b432299b1d63896675a6112f8e06aaf9aaf","tlsh":"fbe09261cc609a7314fc12e568791b07b1625f2b42685c0b34f3b48d66a2126449ef29","path":"package.json"}],"package_integrity":[{"hashes":{"sha1":"89863594917a314d392f5458c2423134d0638349","sha512_sri":"sha512-ttBwu8SPnBNfLLTH96s2SL14wm1Sn4j2IYRzUr6gtpydWnxag5Ymwp6x3l5Lix/g93hmQao6CAyszfPla2aijA=="},"filename":"test12vv36-99.99.99.tgz"}]},"cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/test12vv36/MAL-2026-16311.json"}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}