faceplate-docs

{"schema_version":"1.7.4","id":"MAL-2024-2355","published":"2024-06-25T12:42:27Z","modified":"2026-09-23T01:52:11.715395911Z","summary":"Malicious code in faceplate-docs (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (f5198954164869432a0fda9f3f723c1db53531ab2f73db84523e6f62946cf420)\nfaceplate-docs@99.9.10 runs index.js from a postinstall hook that collects the installer's OS username, current working directory, hostname, and local IPv4 address and POSTs them as JSON to a hardcoded anonymous collector at https://webhook.site/f9bff304-3053-4d54-be05-86537267514a. The beacon fires automatically on `npm install` without any user interaction. The package name plus implausibly high version (99.9.10) and the recon-only payload are characteristic of a dependency-confusion probe designed to identify internal build environments that mistakenly resolve a private package name from the public registry.\n","affected":[{"package":{"name":"faceplate-docs","ecosystem":"npm","purl":"pkg:npm/faceplate-docs"},"versions":["1.0.0","99.9.9","99.9.10"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"43c080ba45f522e0416a363fa622657b37a439a960eedebdbf5b2c56878f7204","tlsh":"b311c2e68cab10140e7177b14c034805f7225732751a9781bdbcc1dd6fa69a5a271eec"}],"package_integrity":[{"filename":"faceplate-docs-99.9.9.tgz","hashes":{"sha1":"d4084e5623cee7f750f749ead53480500f1220ee","sha512_sri":"sha512-uFZgEqT0vlIoEnuaPBfqSq+3hdGW169peONpxTMf1/GZy7AdN4QpcrzbvRF2fymE1RHeS1iOojHu/OA0K2J6jg=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/faceplate-docs/v/99.9.9"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/faceplate-docs/v/99.9.10"}],"database_specific":{"malicious-packages-origins":[{"id":"RLMA-2024-00999","import_time":"2024-06-28T02:43:13.468838694Z","modified_time":"2024-06-25T12:42:27Z","sha256":"62fca832a92eea3afa7f618b4dc1d7836667d7dfebc1bdf74101b3089cd6b4c6","source":"reversing-labs","versions":["1.0.0"]},{"id":"RLUA-2024-06564","import_time":"2024-10-24T00:57:49.579466852Z","modified_time":"2024-10-16T12:52:21Z","sha256":"affa8e86727aac03b3de13a058923786285a642dea2a4caf7e4fbc6f5f3cc5f3","source":"reversing-labs"},{"id":"IN-MAL-2026-020325","import_time":"2026-09-23T01:50:19.031755512Z","modified_time":"2026-09-23T01:37:05Z","sha256":"6f62abf7b41e2c3fc246dbe3a35af15b8ef48e4ce1547e57ba3053668a82e8bd","source":"amazon-inspector","versions":["99.9.9"]},{"id":"IN-MAL-2026-020324","import_time":"2026-09-23T01:50:18.952508207Z","modified_time":"2026-09-23T01:36:53Z","sha256":"f5198954164869432a0fda9f3f723c1db53531ab2f73db84523e6f62946cf420","source":"amazon-inspector","versions":["99.9.10"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"ReversingLabs","contact":["https://www.reversinglabs.com"],"type":"FINDER"}]}