{"id":"MAL-2026-16342","summary":"Malicious code in pflag29424 (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (d9b974c9d8555f026dfc5556c4f628d366fbaedca83eab549559fe95fc984602)\nindex.js (the package's declared main) unconditionally executes on module load: it calls fetch('/profile'), scans the response for a DGA{...} token, and sends either the matched token or the first 300 characters of the response as a query parameter to a hardcoded anonymous collector at https://webhook.site/42c6d937-77c7-42a5-8678-ef06b4501e38. The package has no README, no documented purpose, and a generic throwaway name; the sole effect of loading it is to relay content from the loading context to an attacker-controlled webhook.site endpoint.\n","modified":"2026-09-21T04:00:07.890367673Z","published":"2026-09-21T03:32:53Z","database_specific":{"malicious-packages-origins":[{"import_time":"2026-09-21T03:46:39.33150626Z","modified_time":"2026-09-21T03:32:53Z","sha256":"d9b974c9d8555f026dfc5556c4f628d366fbaedca83eab549559fe95fc984602","source":"amazon-inspector","versions":["1.0.0"],"id":"IN-MAL-2026-020244"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/pflag29424/v/1.0.0"}],"affected":[{"package":{"name":"pflag29424","ecosystem":"npm","purl":"pkg:npm/pflag29424"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"sha256":"a6d0bf00ec30b9d39a51b5fbc799a3aea7fe3062ae31c58958162767ea9c2fa6","tlsh":"d6d02223020c8842157ad008b66df00ddd0aeb02ec6ee26ec2028f381b220649c023a6","path":"index.js"}],"package_integrity":[{"filename":"pflag29424-1.0.0.tgz","hashes":{"sha1":"f3258985cf2fb301b254fd597687d94fad587a4d","sha512_sri":"sha512-4Tud+3+fnomrJ+Zhj2JP+wz6OYDuzsMcGj1n0fysmqTfJj/D9QRdojWzBW7TapYk03jC258mqOcUYhz8SwdFsg=="}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/pflag29424/MAL-2026-16342.json"}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}