{"id":"MAL-2026-16315","summary":"Malicious code in test1ro (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (8166d7eaf8dab64a6c21d0e0a871c64e213147082a414b93816fb080c8044b1e)\npackage.json declares preinstall and postinstall hooks that run `node index.js`, which reads `os.hostname()` and issues an HTTP GET to the hardcoded third-party collector `http://eo8f3m3ho26a0nm.m.pipedream.net/\u003cpackage\u003e?h=\u003chostname\u003e`. The behavior fires automatically during `npm install` without any user action, transmitting the installer's host identifier and the resolved package name to an external Pipedream request-bin. The manifest also declares `test1ro: ^999.99.99` as its own dependency at an implausibly high version, characteristic of a dependency-confusion artifact designed to be resolved from public npm ahead of an internal package of the same name. The generic name, self-referential high-version pin, and install-time beacon to an attacker-controlled collector match the standard dependency-confusion probe shape.\n","modified":"2026-09-21T03:30:17.621945992Z","published":"2026-09-21T03:23:24Z","database_specific":{"malicious-packages-origins":[{"modified_time":"2026-09-21T03:23:46Z","sha256":"8166d7eaf8dab64a6c21d0e0a871c64e213147082a414b93816fb080c8044b1e","source":"amazon-inspector","versions":["999.99.99"],"id":"IN-MAL-2026-020212","import_time":"2026-09-21T03:24:22.034134991Z"},{"id":"IN-MAL-2026-020210","import_time":"2026-09-21T03:24:21.78694115Z","modified_time":"2026-09-21T03:23:24Z","sha256":"9b4c1e61651ca7fc4d5b2dc93bc240ffd6339dfe0fde02e66740517cc9c957bf","source":"amazon-inspector","versions":["99.99.99"]}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/test1ro/v/999.99.99"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/test1ro/v/99.99.99"}],"affected":[{"package":{"name":"test1ro","ecosystem":"npm","purl":"pkg:npm/test1ro"},"versions":["999.99.99","99.99.99"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"85d31266e09f74f188b3569976632d1aef8cab83e7d328572d413c057661d89f","tlsh":"80e02bc707d9b37079e18ec0e03709077386e13635b8c2b4a14d87e95dd2ca509b36e0"},{"sha256":"945bd51f89f48bbff4c92d6c82d5a743b0eaf25ff99033f4a461abd2a1217d4b","tlsh":"52e06551dc509b7314f816d868792b07b1515f2f97685c4b34f3b08da6a222740deb29","path":"package.json"}],"package_integrity":[{"filename":"test1ro-999.99.99.tgz","hashes":{"sha1":"3c02cbcbf4cdbf6a8becead818c0528b21371f83","sha512_sri":"sha512-+n1Hh+06rQpOkt7eeiIzgBlnZ589WQcvugB2ucJFlzcKKNfbOQEEEP7IB/5+xAcUKiZ0zQ785dx0ObdrUqCb3g=="}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/test1ro/MAL-2026-16315.json"}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}