{"id":"MAL-2026-18607","summary":"Malicious code in et_phone_home (npm)","details":"Runs on install. The postinstall script fetches a path from a bare IPv4 address with wget, contacting a remote host from every machine that installs the package. Version examined: 0.0.5; tarball SHA-256 58f9b4c9c26abe6ac52353ce1e0a824fba06c8aa7cefa94d2d4805306053e82c.","modified":"2026-11-04T09:00:05.077204034Z","published":"2026-11-02T09:44:21Z","affected":[{"package":{"name":"et_phone_home","ecosystem":"npm","purl":"pkg:npm/et_phone_home"},"versions":["0.0.5"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/et_phone_home/MAL-2026-18607.json"}}],"schema_version":"1.9.2","credits":[{"name":"Oluwatosin Amokeodo","contact":["mailto:oluwatosin.amokeodo@gmail.com"],"type":"FINDER"}]}