{"id":"MAL-2026-18184","summary":"Malicious code in formatting-subtitles (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (25577370189f57a5678b2f2c45e212abfc79a3675dc7d51581f633e78aba47a6)\npackage.json declares `preinstall: sh./prepare.js && exit 0`. prepare.js is shaped like JavaScript (ending with `console.log('hello world')`) but is executed by /bin/sh, which does not treat `/**... */` as a comment. Inside that block, sh evaluates two `$(...)` command substitutions: one issues a GET to the hardcoded collector https://webhook.site/9e8c8742-3102-4716-aa8b-e150e9e84fe7/stats_1, and the other downloads https://api.github.com/gists/da04f14c93acbe9a7aef827be0a2e91c, extracts a file via jq, writes it to disk as `x`, and runs it with `sh x`. On `npm install`, the installer host fetches and executes arbitrary, unpinned, attacker-controlled content from a mutable GitHub Gist, and the webhook.site beacon discloses the install (and curl-visible metadata such as public IP and user-agent) to the attacker. The JS-comment-wrapping of the shell payload is a deliberate cover story so prepare.js reads as a trivial hello-world when viewed as JavaScript.\n","modified":"2026-10-22T06:45:04.766832011Z","published":"2026-10-22T06:11:06Z","database_specific":{"malicious-packages-origins":[{"modified_time":"2026-10-22T06:11:06Z","sha256":"25577370189f57a5678b2f2c45e212abfc79a3675dc7d51581f633e78aba47a6","source":"amazon-inspector","versions":["1.0.2"],"id":"IN-MAL-2026-021572","import_time":"2026-10-22T06:30:24.231976945Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/formatting-subtitles/v/1.0.2"}],"affected":[{"package":{"name":"formatting-subtitles","ecosystem":"npm","purl":"pkg:npm/formatting-subtitles"},"versions":["1.0.2"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"sha256":"08621cf159a42a51cc7adb68a5de9362791f82d828aa8e06acb5274326b08bc8","tlsh":"d6e07dbf44dc45271b1467c5c6005129f216c188d510ba44d4d1535e78c941121d952a","path":"prepare.js"},{"tlsh":"8ff05910c6315e6306c4baf08dfa10426a221c1b87683d1a7ac3150c9b4d6f744ff7aa","path":"package.json","sha256":"787b8adaeb91abef8536432c18baf565a2ea2d2b8df80daa1d83b216e6ca298d"}],"package_integrity":[{"hashes":{"sha1":"199aa6a0ce2832752c28df0562a3bb854670e31d","sha512_sri":"sha512-XNf+/5pUF/7eiFRxUpcKHIJrwF1DRslpn/Kw6U1FBQbzlM/VBkLTrkvCsU3E2xvMIcpyVAC8tIeOT7cDajsLQQ=="},"filename":"formatting-subtitles-1.0.2.tgz"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/formatting-subtitles/MAL-2026-18184.json"}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}