{"id":"MAL-2026-16341","summary":"Malicious code in pflag14570 (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (2b7164c1405ab2587c562b3b9eb8cdad8258aab8f25b829da64c83d7185eab6c)\nindex.js is an IIFE that executes at module load, reads document.cookie, fetches a list of authenticated application paths (/profile, /admin, /api/me, /settings, and similar), extracts a flag-shaped substring from the responses, and POSTs the aggregated JSON to the hardcoded collector https://webhook.site/42c6d937-77c7-42a5-8678-ef06b4501e38. The package metadata is a stub with no legitimate documented function; the shipped body is a browser-context session-cookie stealer and endpoint scraper directed at a third-party attacker-controlled collector.\n","modified":"2026-09-21T04:00:07.695084442Z","published":"2026-09-21T03:33:01Z","database_specific":{"malicious-packages-origins":[{"import_time":"2026-09-21T03:46:39.410235445Z","modified_time":"2026-09-21T03:33:01Z","sha256":"2b7164c1405ab2587c562b3b9eb8cdad8258aab8f25b829da64c83d7185eab6c","source":"amazon-inspector","versions":["1.0.0"],"id":"IN-MAL-2026-020245"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/pflag14570/v/1.0.0"}],"affected":[{"package":{"name":"pflag14570","ecosystem":"npm","purl":"pkg:npm/pflag14570"},"versions":["1.0.0"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/pflag14570/MAL-2026-16341.json","cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"tlsh":"a2e0ab2b2d2c802e5251b94b353ef250dc25d919b967ccd4c3a94f3eab0b0ea0c916e1","path":"index.js","sha256":"c202f2acedfba0e7c42aa87c77e81413ca1885ffe56406a15467e7f2c59798df"}],"package_integrity":[{"hashes":{"sha1":"d9acbdc652ba29f96ee32a240f5592e62d87c22b","sha512_sri":"sha512-oUvIYG7oMfuJr9pET8ljz8cCzDWF9addibsW4AbGOFDQp325vFRbkSJQpN1MrdwHEfACZs1+9NhDefGDE6Fhrg=="},"filename":"pflag14570-1.0.0.tgz"}]}}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}