{"id":"MAL-2026-19223","summary":"Malicious code in curse-allies-module (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (15e9740e7be22c3d68a1784e48d3e87414347b5e5697397ef0d8ab2295619962)\nOn npm install, the package runs a postinstall lifecycle script (`node probe.cjs`) that issues an HTTPS POST to a hardcoded webhook.site collector URL (https://webhook.site/a4bf0f9f-6d96-46e6-80ac-b76a5329f481) with the marker string `CURSE_DEPENDENT_REMOTE_INSTALL_PROBE`. The beacon fires unconditionally at install time with no configuration or opt-out, signaling to a third-party collector that the package resolved and executed inside the installer's environment. This is the canonical dependency-confusion / reconnaissance canary shape: the attacker learns that a given name resolves on the target's internal build infrastructure, enabling follow-on targeted attacks against environments where the name was expected to resolve privately.\n","modified":"2026-11-13T04:30:04.724214332Z","published":"2026-11-13T03:55:32Z","database_specific":{"malicious-packages-origins":[{"versions":["1.0.0"],"id":"IN-MAL-2026-022765","import_time":"2026-11-13T04:13:31.156182124Z","modified_time":"2026-11-13T03:55:32Z","sha256":"15e9740e7be22c3d68a1784e48d3e87414347b5e5697397ef0d8ab2295619962","source":"amazon-inspector"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/curse-allies-module/v/1.0.0"}],"affected":[{"package":{"name":"curse-allies-module","ecosystem":"npm","purl":"pkg:npm/curse-allies-module"},"versions":["1.0.0"],"database_specific":{"indicators":{"package_integrity":[{"filename":"curse-allies-module-1.0.0.tgz","hashes":{"sha1":"61f953196790e9fb8097bee94cb1d2c3e457ec97","sha512_sri":"sha512-6RtzDTkFgVxARZBg7T6nZC/O4bftY5RffXwmghvO8GTzOFqmIIBnNDAOxRr/PVe8FUtjfNZiETYCQQ21D2euhQ=="}}],"evidence_files":[{"path":"probe.cjs","sha256":"4abea57296fcf327101908ce52d35a65c198f297bf01e0176ef561d509f351d1","tlsh":"e5e061f491f2205625e8c2c4d1115ccad797c521f54e9740f78522351ac91f5457578e"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/curse-allies-module/MAL-2026-19223.json","cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}]}}],"schema_version":"1.9.2","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}