{"id":"MAL-2026-18288","summary":"Malicious code in jshelperdependenceny (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (dc4d19697f4104351bb25b7e568018ec6ed85d626b7265fb4b9682ae12183be9)\nnpm package 'jshelperdependenceny' is published at version 99.0.0 with a preinstall banner stating it is intended to shadow an internal v1.0.0 package of the same name — the classic dependency-confusion shape of using an inflated version to win resolution against a private registry. On install, package.json runs 'node preinstall.js || true', which collects os.hostname(), os.platform(), os.arch(), and the package name/version and POSTs them as JSON to a URL taken from the DC_CALLBACK_URL environment variable, defaulting to http://127.0.0.1:5656/exfil. The env-var override turns the loopback default into a functional attacker-configurable beacon that fires automatically on npm install and discloses installer host identifiers plus confirmation that the shadowed internal name resolved to this public artifact.\n","modified":"2026-10-25T15:30:04.534065372Z","published":"2026-10-25T15:11:25Z","database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-021708","import_time":"2026-10-25T15:15:15.735847913Z","modified_time":"2026-10-25T15:11:25Z","sha256":"dc4d19697f4104351bb25b7e568018ec6ed85d626b7265fb4b9682ae12183be9","source":"amazon-inspector","versions":["99.0.0"]}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/jshelperdependenceny/v/99.0.0"}],"affected":[{"package":{"name":"jshelperdependenceny","ecosystem":"npm","purl":"pkg:npm/jshelperdependenceny"},"versions":["99.0.0"],"database_specific":{"cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}],"indicators":{"evidence_files":[{"sha256":"d488b536febbb35576cf33efe029f8ffa868385e41a93a03f5191ec52d8660b4","tlsh":"7681a8b24490772127aace8410b2fc6e532975d0e9326814f9cd65c42ffe964de22df7","path":"preinstall.js"},{"path":"package.json","sha256":"5b10d51a2d0e72d6033fcc5fe9c54944af469fa80b9d32febead0f87f55c19e9","tlsh":"25e0c2344d24b43319f44bd069975116b5a10e1a42587c1c67e7202b02be7b349bfa2e"}],"package_integrity":[{"hashes":{"sha1":"f231f901c512837ed3afe7dc32a6dd958b919c6c","sha512_sri":"sha512-glsd4SZCEss3PWy3s1tLVIcjCA0+2+KoO3Ib0uYftuph2cWFv6S56aaCwJ2/DmKW3q7uLlfUltA4o3WtVztUsg=="},"filename":"jshelperdependenceny-99.0.0.tgz"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/jshelperdependenceny/MAL-2026-18288.json"}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}