{"id":"MAL-2026-16434","summary":"Malicious code in catplatebarcodeparser (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (189a06b0d55d6dab795bcb9ba3a97aa855b2556a54e85e15adc9f5bf20399976)\ncatplatebarcodeparser@99.2.1 declares preinstall and postinstall lifecycle scripts that execute scripts/run.js on `npm install`. That script reads os.userInfo().username and os.hostname() and POSTs them to a hardcoded out-of-band collector at https://webhook.site/40e9b065-efd7-43a5-916f-3d52281f42b6, and additionally issues a DNS lookup against 40e9b065-efd7-43a5-916f-3d52281f42b6.dnshook.site as a canary. The version number (99.2.1) and package name pattern are consistent with a dependency-confusion lure intended to win resolution against an internal package of the same name; installing the lure automatically leaks installer identity to an author-controlled endpoint.\n","modified":"2026-09-23T02:00:06.974869634Z","published":"2026-09-23T01:40:51Z","database_specific":{"malicious-packages-origins":[{"import_time":"2026-09-23T01:50:19.199329521Z","modified_time":"2026-09-23T01:40:51Z","sha256":"189a06b0d55d6dab795bcb9ba3a97aa855b2556a54e85e15adc9f5bf20399976","source":"amazon-inspector","versions":["99.2.1"],"id":"IN-MAL-2026-020327"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/catplatebarcodeparser/v/99.2.1"}],"affected":[{"package":{"name":"catplatebarcodeparser","ecosystem":"npm","purl":"pkg:npm/catplatebarcodeparser"},"versions":["99.2.1"],"database_specific":{"cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}],"indicators":{"evidence_files":[{"tlsh":"db2111fa89f981181ef341c0a34fdc5aa123e60a7442eaa0769d03721f899ed45338f8","path":"scripts/run.js","sha256":"167124ed0e79a45403d7f00a8ee93bd8e584333988f2afdd20b7b8cae13e96a7"}],"package_integrity":[{"filename":"catplatebarcodeparser-99.2.1.tgz","hashes":{"sha1":"af1d793c8987c66ad4cb785d1f9d51caf9f90cb9","sha512_sri":"sha512-rTnGT8hj2KZmi0qlShANa0Ffr5+IxhwBswPbxeIyFCsxcKvBRi599SSk3umh34DqD+k+o8Kcr8C1SlACc1UZMQ=="}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/catplatebarcodeparser/MAL-2026-16434.json"}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}