{"id":"MAL-2026-4391","summary":"Malicious code in @gad360/apothem (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (4f5e509ba6aa2f781391f03ff37ea8005440c1d1106391bdfa91abae06336ad3)\nThe package's package.json declares a postinstall hook (\"postinstall\": \"node install.js\") that runs install.js automatically on npm install. install.js requires fs, os, https, and child_process, reads environment variables and host metadata (process.env, process.platform, process.arch, os.tmpdir, fs.readFileSync), and issues an https.get to the hardcoded endpoint https://ahmedgad.com. The combination of a hardcoded non-publisher destination with environment/system reads inside a lifecycle script is the canonical install-time exfiltration shape. The destination is unrelated to any documented vendor SDK or runtime CDN, and there is no version pinning, hash verification, or build-from-source justification for the network call.\n","modified":"2026-05-26T06:01:49.231308166Z","published":"2026-05-21T00:51:45Z","database_specific":{"malicious-packages-origins":[{"import_time":"2026-05-26T05:51:03.9384998Z","modified_time":"2026-05-21T00:51:45Z","sha256":"4f5e509ba6aa2f781391f03ff37ea8005440c1d1106391bdfa91abae06336ad3","source":"amazon-inspector","versions":["1.1.0"],"id":"IN-MAL-2026-003662"},{"id":"IN-MAL-2026-003663","import_time":"2026-05-26T05:51:04.038250214Z","modified_time":"2026-05-21T00:51:46Z","sha256":"ad5f5b336ec6522037b3042e4f0adf68e9cd2e0fb4d94789f9ef5b1bc158b912","source":"amazon-inspector","versions":["1.1.0"]}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@gad360/apothem/v/1.1.0"}],"affected":[{"package":{"name":"@gad360/apothem","ecosystem":"npm","purl":"pkg:npm/%40gad360%2Fapothem"},"versions":["1.1.0"],"database_specific":{"indicators":{"package_integrity":[{"hashes":{"sha512_sri":"sha512-UEohNZbKX/AgTao0vNr2oN2RV27bNVTBywwi7xmIUYwZ4hbgSUYoMVmTM1uPFNcnAaFMXuhObVDv8pFG9UMWpQ==","sha1":"edd5a51e77c387d0989177ffc51c72842cb007ee"},"filename":"apothem-1.1.0.tgz"}],"domains":["github.com"],"evidence_files":[{"path":"install.js","sha256":"ecfa2c6da67a9edc50b3004271598e9821ee716ae200c05d4f72fca49ac98a8e","tlsh":"8d81644e05f3523042f365e6d66ba216a80b448bf106dd48faec93456fd3460ce63bee"},{"path":"package.json","sha256":"79242f7ee71d7a79194cbfd9a089b17fab6e0c72f831fb51eb43ef70b936bdef","tlsh":"9c119e61d7b10d630ed839905c3b114aa92a09d78d44bc2db793a11c0f5f02f12be7ed"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@gad360/apothem/MAL-2026-4391.json","cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}]}}],"schema_version":"1.7.5","credits":[{"name":"Amazon Inspector","contact":["actran@amazon.com"],"type":"FINDER"}]}