{"id":"MAL-2026-4668","summary":"Malicious code in share-anything-cli (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (290f9dadaf589349dd8a7c641450aca713a6ead63b2ba685c15e4e6a37ab3b07)\nThe package's package.json declares a postinstall lifecycle hook (`\"postinstall\": \"node install.js\"`) that runs install.js automatically on `npm install`. install.js requires `child_process` and `https`, gathers host data (process.platform branches and environment/process information), and issues an outbound `https.get(...)` call. This is the system-info exfiltration shape: an install-time script with no advertised purpose other than collecting host details and beaconing them out. Installing this package causes uncontrolled host information to leave the installer's machine before any of the package's CLI is ever invoked.\n","modified":"2026-05-27T00:32:12.978081574Z","published":"2026-05-22T13:21:24Z","withdrawn":"2026-05-26T18:52:22Z","database_specific":{"malicious-packages-origins":[{"sha256":"290f9dadaf589349dd8a7c641450aca713a6ead63b2ba685c15e4e6a37ab3b07","source":"amazon-inspector","versions":["0.5.6"],"id":"IN-MAL-2026-004203","import_time":"2026-05-26T05:52:08.226870168Z","modified_time":"2026-05-22T13:21:24Z"},{"source":"amazon-inspector","versions":["0.5.6"],"id":"IN-MAL-2026-004207","import_time":"2026-05-26T05:52:08.920555044Z","modified_time":"2026-05-22T13:29:57Z","sha256":"67271f386de502189d802c6fce3d4e90202cd70015be9f2a94948e29bfbaceb2"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/share-anything-cli/v/0.5.6"}],"affected":[{"package":{"name":"share-anything-cli","ecosystem":"npm","purl":"pkg:npm/share-anything-cli"},"versions":["0.5.6"],"database_specific":{"indicators":{"domains":["github.com","release-assets.githubusercontent.com"],"evidence_files":[{"path":"install.js","sha256":"3bdb898377bfcc2fa2df636b5fd61255bdfd41deb114bf0858896f91869fcf16","tlsh":"5d41420d14f3143642b7f8d6aa8b7417a58780233206dd8cfa6c87496fd7464d2a7add"},{"tlsh":"cd014950c8309d3329e42db15c6f604993220c0b9d443c0a739b110c4f2f16fb17e9de","path":"package.json","sha256":"9bf268e567651f4eb4d4699d2b34d5e2f8e45d1d96373c15b0371891a4eb076e"}],"package_integrity":[{"filename":"share-anything-cli-0.5.6.tgz","hashes":{"sha1":"58a159c4acfe1e2d7077d505a2ff075414075ae7","sha512_sri":"sha512-OP3nEHGnIxtvrxClgqwznkeyCYxtTSnBiF8APQJIF/O+/EeHm/YCnYTFJZksoi9snE9F6f0izxM5CBiJ5bk1mw=="}}]},"cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/withdrawn/npm/share-anything-cli/MAL-2026-4668.json"}}],"schema_version":"1.7.5","credits":[{"name":"Amazon Inspector","contact":["actran@amazon.com"],"type":"FINDER"}]}