eslint-plus

{"modified":"2026-07-09T17:21:21Z","published":"2026-07-09T16:50:45Z","schema_version":"1.7.4","id":"MAL-2026-10087","summary":"Malicious code in eslint-plus (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (fbc3baf80e31e8027d7bb5b3fe5a873c5ff72d8344d39f8f01e191699a2310d7)\nPackage declares `postinstall: node lib/utils/index.js`, which spawns a detached, stdio-suppressed Node child (spawn with detached:true, stdio:'ignore', child.unref()) that runs lib/utils/smtp-connection/index.js. That script uses axios to GET https://jsonkeeper.com/b/UTUUE and passes the response's `cookie` field to `new Function(\"require\",...)(require)`, executing whatever JavaScript the anonymous mutable paste currently returns with full Node privileges on the installer's machine. jsonkeeper.com is a public, anonymously-editable JSON paste service, so the executed code can be silently swapped by the operator at any time. The detach + stdio-ignore + unref pattern is designed to survive after `npm install` exits and to hide output from the installer. Separately, the package is named `eslint-plus` and its homepage/description reference React Training and eslint tooling, but `main` points at `lib/nodemailer.js` and the tarball ships a copied nodemailer source tree authored by 'Andris Reinman' — a namespace/impersonation cover for the dropper.\n","affected":[{"package":{"ecosystem":"npm","name":"eslint-plus"},"versions":["6.0.5","6.0.4"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"lib/utils/smtp-connection/index.js","sha256":"272e2630805ca7c17b8fa9fb97b72ccde362c001c0feed643ecd0cd9c9e8bb26","tlsh":"d7c0806b37c8651e212610e6674e50147123c9334d46d4d9f3550bf665e1ec61a21eb5"},{"path":"lib/utils/index.js","sha256":"9fb27c30f484650bb4a39f65a03fbccdc0b9b5f1cb84700ca73ee8893c66e06e","tlsh":"dae0686a23533738a034cbc1da30ce3b258b8020b365a0e0f00c406a2bc72c406ea8da"},{"path":"package.json","sha256":"f0e9c766900ea6930e946fd1ae532fdcc3ba0a215ca3f687c0265069fa43bba8","tlsh":"1341ef15ce6a8ce3279525ee786c22826460d00fcd47b81db39d134c8f8e95f32b9a6d"}],"package_integrity":[{"filename":"eslint-plus-6.0.5.tgz","hashes":{"sha1":"ade5bbafd821909a086f377ab68ed84795035eb1","sha512_sri":"sha512-qXTs/NYqDQhPtzHQ81rL7Oja60YfZMMyMCWXqOl7GfBipGVa+nBh3QYp+e1aCv9Va0n6g0bHR4q7jerxkPHz9g=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/eslint-plus/v/6.0.5"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/eslint-plus/v/6.0.4"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-009324","import_time":"2026-07-09T17:19:23.955949626Z","modified_time":"2026-07-09T16:50:45Z","sha256":"6360adb10a187657f54fabe4bfa066299ac0bfde2e8d932ede94dd5ef702764e","source":"amazon-inspector","versions":["6.0.5"]},{"id":"IN-MAL-2026-009325","import_time":"2026-07-09T17:19:24.075948899Z","modified_time":"2026-07-09T16:50:52Z","sha256":"fbc3baf80e31e8027d7bb5b3fe5a873c5ff72d8344d39f8f01e191699a2310d7","source":"amazon-inspector","versions":["6.0.4"]}]}}