{"id":"MAL-2026-6570","summary":"Malicious code in pkg-fallback (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (c97ea590e70f499f40938e093cd6a09a13b95030872968b5d325fee8a595f31c)\nPackage advertises itself as a small string-manipulation library (trim, case, pad, wrap) but its install-time behavior is a dropper. package.json declares a direct dependency `native-bridge` as `http://157.254.194.200:8080/native-bridge-1.0.0.tar.gz` — a plain-HTTP tarball on a bare IP unrelated to any publisher. On `npm install`, npm fetches that arbitrary tarball and installs it into the consumer's node_modules tree, running its own lifecycle scripts. Additionally, the declared postinstall script (`scripts/check-binary.js`) downloads a second tarball, `npm-dependency-payload-1.0.0.tar.gz`, over plain HTTP from the same bare IP and writes it to `.cache/native.tgz` with errors silently swallowed. Neither fetch is pinned, hash-verified, or sourced from publisher infrastructure, and the shipped tarball contains no native source code that would justify a native-bridge dependency. The string-utility cover story is inconsistent with the install-time behavior, which is the deliberate-evasion shape of a supply-chain dropper.\n","modified":"2026-06-29T05:16:42.636070702Z","published":"2026-06-29T04:26:41Z","database_specific":{"malicious-packages-origins":[{"source":"amazon-inspector","versions":["1.1.0"],"id":"IN-MAL-2026-007723","import_time":"2026-06-29T05:07:07.242244764Z","modified_time":"2026-06-29T04:26:41Z","ranges":[{"events":[{"introduced":"0"}],"type":"SEMVER"}],"sha256":"c97ea590e70f499f40938e093cd6a09a13b95030872968b5d325fee8a595f31c"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/pkg-fallback/v/1.1.0"}],"affected":[{"package":{"name":"pkg-fallback","ecosystem":"npm","purl":"pkg:npm/pkg-fallback"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"versions":["1.1.0"],"database_specific":{"indicators":{"package_integrity":[{"hashes":{"sha1":"825c8bc5dbdc54ff3f3092a202c68bff671d78c2","sha512_sri":"sha512-BrsqWdRFG7Z68KRkDt0N+1S/YJ9DO/sohLdwfeTR1EmnJ7A+sbCGjrZsKQvoZwYlST2xOF7VV0Y6iddooZ7JFg=="},"filename":"pkg-fallback-1.1.0.tgz"}],"evidence_files":[{"path":"package.json","sha256":"cef05a78e24cffd4a77e7e7ef390a31a8b0ce58d3754950b56cf225219b11273","tlsh":"35f0d4004e22463306dcaba71c3a11c35a744907094d7c3d72c7000c475c18a17ff32c"},{"tlsh":"3a1123de15f02518d4b1b759c1bfc56aa5f7e0216347a644e098c59a0f704610712c7c","path":"scripts/check-binary.js","sha256":"fb18884ad31b2142656181b040f7dcf87c410ddb9e9898c466a5d8576a53749b"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/pkg-fallback/MAL-2026-6570.json","cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}]}}],"schema_version":"1.7.5","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}