{"id":"MAL-2026-16465","summary":"Malicious code in helpersutils-dev-tools (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (85b7208dea3cf1742ac01332c17db9df968fd4a105fbccaf0b5388162b0f3673)\nThe package presents itself as 'Development utility helpers' but its main module executes an IIFE at require-time that issues an Image request to http://5.189.173.113:8899/csp-edu with document.domain appended as a query parameter. A sibling file bypass.js contains an equivalent beacon to http://5.189.173.113:8899/csp. Both destinations are a hardcoded bare IP over plain HTTP, unrelated to any advertised functionality, and receive host-context data (the consuming page's domain) whenever the module is loaded.\n","modified":"2026-09-23T05:30:06.433597146Z","published":"2026-09-23T04:56:40Z","database_specific":{"malicious-packages-origins":[{"versions":["1.0.11"],"id":"IN-MAL-2026-020457","import_time":"2026-09-23T05:18:35.434266907Z","modified_time":"2026-09-23T04:56:40Z","sha256":"85b7208dea3cf1742ac01332c17db9df968fd4a105fbccaf0b5388162b0f3673","source":"amazon-inspector"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/helpersutils-dev-tools/v/1.0.11"}],"affected":[{"package":{"name":"helpersutils-dev-tools","ecosystem":"npm","purl":"pkg:npm/helpersutils-dev-tools"},"versions":["1.0.11"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/helpersutils-dev-tools/MAL-2026-16465.json","cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}],"indicators":{"evidence_files":[{"sha256":"513bf3bb90c0a9e18d2ee1d2d5e0980311e544ea7a739a31b01730050b1072eb","tlsh":"b1b09bac142c6564ccda501c316f594bd8e47d411c935545d516555407241117562b55","path":"index.js"},{"tlsh":"65b012bc050c577448c2e842b492ecd3eda53d4f9df2eae5d60d19147142c26b976747","path":"bypass.js","sha256":"bb5567181ca8455a609d18285df69a78c847e188124f29159fecdacedb764cc5"}],"package_integrity":[{"filename":"helpersutils-dev-tools-1.0.11.tgz","hashes":{"sha1":"3495ac80408eaf684a2ea89f3bdc4aea1b4904e9","sha512_sri":"sha512-7s7S4e3U7jvVW4+VeZyTq23tKP44/254h8yQAY9k+IwipW7C9KtY28QzqxH0xCHRSpsTFD+5Q8Hoc9s0rQdnQQ=="}}]}}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}