myreviews-core

{"modified":"2026-07-16T18:38:13Z","published":"2026-07-16T18:38:13Z","schema_version":"1.7.4","id":"MAL-2026-10740","summary":"Malicious code in myreviews-core (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (9c41d5d4352e265f0efbc0089a19c5773ceeb76c0265831eeeeca19151fe4f64)\npackage.json declares a postinstall lifecycle hook that runs `node -e` to issue an HTTPS GET to a hardcoded webhook.site collector URL, appending the installer's hostname (`os.hostname()`), OS username (`os.userInfo().username`), current working directory (`process.cwd()`), and a timestamp as query parameters. The request fires automatically on `npm install` with no opt-in and no relation to any documented package functionality. The version number (99.0.0) is consistent with a dependency-confusion lure intended to shadow an internal package name and beacon successful installs to the attacker.\n","affected":[{"package":{"ecosystem":"npm","name":"myreviews-core"},"versions":["99.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"package.json","sha256":"af5daedc6a4bff669320853ae2e6068fbeb5921f944cb1712b8f4c497f167b2a","tlsh":"b4e0ab790524857738c802f109034809b9a2dc260088bc18ebbba20c5be5af23af59a8"}],"package_integrity":[{"filename":"myreviews-core-99.0.0.tgz","hashes":{"sha1":"574b8982766f76bea1da7569501983daf142db16","sha512_sri":"sha512-+zsXWc1VtYRixJ+x5PCURjDh0SRw1dLbwUX4ML/uwQEUMH+eHGp05d9HdAMFFnyX9KGAnRiGrkYlb/iz0aLiGg=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/myreviews-core/v/99.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-010725","import_time":"2026-07-16T18:54:01.375432066Z","modified_time":"2026-07-16T18:38:13Z","sha256":"9c41d5d4352e265f0efbc0089a19c5773ceeb76c0265831eeeeca19151fe4f64","source":"amazon-inspector","versions":["99.0.0"]}]}}