{"id":"MAL-2026-16480","summary":"Malicious code in a-onesite (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (1b1ed6ca931448c083b5356eae6ad5af3cce9011d70fce4ce4ad427349991856)\na-onesite@99.9.9 ships an empty index.js and no library functionality. Its package.json declares preinstall, preupdate, and test scripts that all invoke wget against http://eoy34oyrep9j5x8.m.pipedream.net with the installer's username ($(whoami)), current working directory ($(pwd)), and hostname ($(hostname)) as query parameters. The preinstall hook fires automatically on `npm install`, sending installer-identifying reconnaissance data over plaintext HTTP to a third-party collection endpoint unrelated to any advertised purpose. The version number (99.9.9) and empty code payload are consistent with a dependency-confusion reconnaissance beacon rather than a functional package.\n","modified":"2026-09-23T19:01:50.933201267Z","published":"2026-09-23T18:29:39Z","database_specific":{"malicious-packages-origins":[{"source":"amazon-inspector","versions":["99.9.9"],"id":"IN-MAL-2026-020495","import_time":"2026-09-23T18:44:13.368503244Z","modified_time":"2026-09-23T18:29:39Z","sha256":"1b1ed6ca931448c083b5356eae6ad5af3cce9011d70fce4ce4ad427349991856"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/a-onesite/v/99.9.9"}],"affected":[{"package":{"name":"a-onesite","ecosystem":"npm","purl":"pkg:npm/a-onesite"},"versions":["99.9.9"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/a-onesite/MAL-2026-16480.json","indicators":{"package_integrity":[{"hashes":{"sha1":"a5222f038b75628e8f0b7657e1a5507f6db41f80","sha512_sri":"sha512-tQdZ6f+dTHDn/BhU+3uJvhaXpoehya97vUbl8dG8BAQlArz6wbSr3/gnG+xhZpDIe24UBWVnpM+QnXR0Xg4p8Q=="},"filename":"a-onesite-99.9.9.tgz"}],"evidence_files":[{"tlsh":"94f050fde838ef4319878f6435614366f0627b6711056c19dbf12d04595c8e134b6554","path":"package.json","sha256":"dd1671c200cc2043ad742b44505f30c7f4f7df960f43b874c55bac97604ab5bd"},{"path":"index.js","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"}]}}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}