{"id":"MAL-2026-19224","summary":"Malicious code in helper-agent (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (4ab651b6042b8ef6c2c986a58d276931d9353d723fd914c9b7c728cac5cf0fc9)\nThe package declares a postinstall script `node probe.cjs` that fires on every `npm install`. On execution it POSTs install-start and status markers to a hardcoded webhook.site dead-drop (https://webhook.site/a4bf0f9f-6d96-46e6-80ac-b76a5329f481), then scans several localhost ports (1337, 80, 3000, 8080, 5000) for a specific JSON API and, when a matching record (id `ECT-987654`) is found, issues a PUT that overwrites that service's manifest with an author-chosen status string. Both the outbound beacon destination and the local mutation target are hardcoded and not user-configurable. The package.json self-describes as an \"Authorized HTB dependency-resolution canary\" and the mutation path is gated to a narrow challenge record, but the install-time outbound beacon and localhost scanning fire unconditionally for any installer, confirming installer execution to a third-party collector and granting the author write access to a matching local service on the installer's host.\n","modified":"2026-11-13T04:30:04.705720527Z","published":"2026-11-13T03:55:49Z","database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-022767","import_time":"2026-11-13T04:13:31.350640292Z","modified_time":"2026-11-13T03:55:58Z","sha256":"4ab651b6042b8ef6c2c986a58d276931d9353d723fd914c9b7c728cac5cf0fc9","source":"amazon-inspector","versions":["1.0.4"]},{"modified_time":"2026-11-13T03:55:49Z","sha256":"f01dff7c435620ecbed6343306f78e4402baebad429485c0946687951bd98ea3","source":"amazon-inspector","versions":["1.0.1"],"id":"IN-MAL-2026-022766","import_time":"2026-11-13T04:13:31.247913509Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/helper-agent/v/1.0.4"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/helper-agent/v/1.0.1"}],"affected":[{"package":{"name":"helper-agent","ecosystem":"npm","purl":"pkg:npm/helper-agent"},"versions":["1.0.4","1.0.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"tlsh":"5851559c14fb101902efe575ebbb7026b3769503208d8f007b9e43552f892a99da56ce","path":"probe.cjs","sha256":"5637bf88c6a410be78fba1205a14b7f4cd4e0101a44d2d1a87f8fd8f762f58c7"}],"package_integrity":[{"filename":"helper-agent-1.0.4.tgz","hashes":{"sha1":"f2fada4070081fc6d794f6c39bb7b947f2f7f569","sha512_sri":"sha512-uuI4u/4f2bneAvPAncFrludreIugY3J6B8rq0FspoyhuQ3IhHcK/4iIp96QkxmJWeln/OW3cNkY6FeM11ujTTQ=="}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/helper-agent/MAL-2026-19224.json"}}],"schema_version":"1.9.2","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}