cbr-internal-utils

{"modified":"2026-07-14T03:53:29Z","published":"2026-07-14T03:53:29Z","schema_version":"1.7.4","id":"MAL-2026-10530","summary":"Malicious code in cbr-internal-utils (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (fa96f42fade399b9e73756e2abd62eafbfa11e2eb02fe1055d9c7e025fba4ab7)\nOn module load, the package's main entrypoint shells out via child_process.exec to run `cat /etc/passwd` and prints the contents to stdout. This fires unconditionally when any consumer `require()`s the package — no user action or configuration is needed. The package has an internal-sounding name and empty author/description metadata, consistent with a dependency-confusion probe or reconnaissance payload rather than a legitimate library. Reading /etc/passwd serves no library purpose and enumerates local user accounts on the installer's host.\n","affected":[{"package":{"ecosystem":"npm","name":"cbr-internal-utils"},"versions":["2.2.2"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"6b562c1c355be3ce3dc94b89eb42d815f0eec0319497af9ea53cec7b99f2f491","tlsh":"7ce0d8052de65537933754b0a605591b330bc501123dea96a69a47347fc45a0cde12ea"}],"package_integrity":[{"filename":"cbr-internal-utils-2.2.2.tgz","hashes":{"sha1":"5afa4e695220aaaeeea271c5535445f02123671a","sha512_sri":"sha512-ZK7Kj5bnno1AccMVwSWUEzu0vj59T3JOTBA4rI8eE4BJ3cc/IDY3OVofiWUuuzRBQgqo6sy051N/NanzEfEcKA=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/cbr-internal-utils/v/2.2.2"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-010385","import_time":"2026-07-14T04:32:00.222928009Z","modified_time":"2026-07-14T03:53:29Z","sha256":"fa96f42fade399b9e73756e2abd62eafbfa11e2eb02fe1055d9c7e025fba4ab7","source":"amazon-inspector","versions":["2.2.2"]}]}}