{"id":"MAL-2026-6184","summary":"Malicious code in @qlab/component-intelligence (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (9ad49caeee790003270d74c5b17a58d0cef6f04d881efe83b0f6c7e11515e934)\npackage.json declares a preinstall hook (`\"preinstall\": \"node index.js\"`) that fires automatically on `npm install`. index.js requires os, dns, https, querystring, and the package's own package.json, then collects the installer's hostname (`os.hostname()`), username (`os.userInfo().username`), home directory (`os.homedir()`), configured DNS servers (`dns.getServers()`), current working directory, and the full contents of package.json, and POSTs them via HTTPS to the hardcoded webhook `https://eo1e4fhn1i67p8r.m.pipedream.net/`. This is the canonical dependency-confusion / recon-beacon shape: host identifiers and internal package metadata leave the machine unconditionally at install time to an attacker-controlled endpoint, giving the attacker reconnaissance data on internal package names, corporate hostnames, and user identities to fuel follow-on supply-chain attacks.\n","modified":"2026-06-19T05:31:48.526763797Z","published":"2026-06-19T05:02:33Z","database_specific":{"malicious-packages-origins":[{"sha256":"9ad49caeee790003270d74c5b17a58d0cef6f04d881efe83b0f6c7e11515e934","source":"amazon-inspector","versions":["2.0.6"],"id":"IN-MAL-2026-007053","import_time":"2026-06-19T05:16:49.673638041Z","modified_time":"2026-06-19T05:02:33Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@qlab/component-intelligence/v/2.0.6"}],"affected":[{"package":{"name":"@qlab/component-intelligence","ecosystem":"npm","purl":"pkg:npm/%40qlab%2Fcomponent-intelligence"},"versions":["2.0.6"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@qlab/component-intelligence/MAL-2026-6184.json","cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"sha256":"a7e18272aee814e3f4f821b4b911ff6586a8ee7170087ebdb52d99f61d0e789a","tlsh":"8811afd885e123600d7645c47899d00916aad737790e6ddcf5cc06d04f89abd60b3af5","path":"index.js"}],"package_integrity":[{"hashes":{"sha512_sri":"sha512-zjkAaMsFeEqiE3wBWzihg8kfpCQvb8ZIsWqc2OUiubCbHhnvduS7LM4X87P7KIi8nknMOhJRm5PG//7XnhKT/g==","sha1":"b4553f86de5b9418a4e20dcd0f4ab8f807b94a85"},"filename":"component-intelligence-2.0.6.tgz"}]}}}],"schema_version":"1.7.5","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}