{"id":"MAL-2026-4702","summary":"Malicious code in vestibulect (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (82da0f0bb40f42e69defbea694db093f2ad880c8c094508f61e2d7fe58550e2e)\npackage.json declares a postinstall hook (\"postinstall\": \"node install.js\") which executes install.js automatically on `npm install`. install.js imports `fs` and `https`, enumerates the filesystem via `fs.readdirSync(...)` and reads file contents with `fs.readFileSync(...)`, then performs outbound network calls via `https.get(...)`. This combination — directory enumeration, file read, and unconditional outbound HTTPS in an install lifecycle script — is the canonical filesystem-to-network exfiltration shape and produces a direct attacker benefit: any developer or CI machine running `npm install vestibulect` has local file contents transmitted off-host to whatever destination the script chooses. The package has no advertised purpose that would justify reading local files at install time.\n","modified":"2026-05-27T00:32:08.681277341Z","published":"2026-05-20T02:32:53Z","withdrawn":"2026-05-26T19:00:35Z","database_specific":{"malicious-packages-origins":[{"source":"amazon-inspector","versions":["0.0.1"],"id":"IN-MAL-2026-003422","import_time":"2026-05-26T05:50:36.802273352Z","modified_time":"2026-05-20T02:32:53Z","sha256":"82da0f0bb40f42e69defbea694db093f2ad880c8c094508f61e2d7fe58550e2e"},{"source":"amazon-inspector","versions":["0.0.1"],"id":"IN-MAL-2026-003423","import_time":"2026-05-26T05:50:36.899870932Z","modified_time":"2026-05-20T02:32:53Z","sha256":"f547a05c2fbb1c1520a8ef9fb763f154d5922146573fe178e9dfdccf1670ca09"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/vestibulect/v/0.0.1"}],"affected":[{"package":{"name":"vestibulect","ecosystem":"npm","purl":"pkg:npm/vestibulect"},"versions":["0.0.1"],"database_specific":{"cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}],"indicators":{"package_integrity":[{"filename":"vestibulect-0.0.1.tgz","hashes":{"sha1":"471b937d0627de7d063abc83b7d6e50ff7a077fe","sha512_sri":"sha512-XXAt5FHTHixmd3goN6RBhyB3z1hpEtEX7Dzhp1E+umeN/LQE8Jdz1WQo5myXNQLuGATgmxB7RqEoTKap2endrw=="}}],"domains":["github.com","release-assets.githubusercontent.com"],"evidence_files":[{"path":"install.js","sha256":"0705ac578ea2de9f689f7da9caac280446f2f71b059c2cdb294597e5bbe33d6e","tlsh":"86f1408c56f31331427761da8a9b500ae1229043380fcd98bfac97867fd4638e597ef9"},{"tlsh":"7ee09220c8214d3369c45b944c6a650bb6520c5740147d2537e7101c8baf22e54bf22e","path":"package.json","sha256":"646bd3246183e667d0232546f6c5d1308e32c3216b341f3c80111430a3120e51"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/withdrawn/npm/vestibulect/MAL-2026-4702.json"}}],"schema_version":"1.7.5","credits":[{"name":"Amazon Inspector","contact":["actran@amazon.com"],"type":"FINDER"}]}