blots

{"schema_version":"1.7.4","id":"MAL-2026-11158","published":"2026-07-28T13:38:48Z","modified":"2026-08-05T14:22:10.815718323Z","summary":"Malicious code in blots (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (847ba592915f4561a16225808a93d2428bc12305dc3df0bbf5316bf5a5bd7518)\npackage.json defines preinstall and postinstall lifecycle scripts that unconditionally run curl against a hardcoded webhook.site endpoint, transmitting the installer's username (whoami), hostname, current working directory, and timestamp as query parameters. The endpoint is a third-party request-capture service controlled by the author (https://webhook.site/d80b4602-8a87-4693-8510-6ff77c62788e/blots). The package ships no other functionality tied to a documented purpose; the sole install-time effect is reconnaissance of the installer's host and identity to an attacker-controlled destination.\n\n## Source: ossf-package-analysis (57066a6751b0444f7693ed35561fa24c16c649be8ce94c692b63f0470784866a)\nThe OpenSSF Package Analysis project identified 'blots' @ 2.1.0 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package executes one or more commands associated with malicious behavior.\n","affected":[{"package":{"name":"blots","ecosystem":"npm"},"versions":["2.1.0","2.1.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"package.json","sha256":"d4a27a7d84d3514d831137b73a45a578075d1465bba3849caabfad206c730424","tlsh":"6af081b2582878733ec641981e4d430ab944bb1b81017529a327f92419cd66f56bf327"}],"package_integrity":[{"filename":"blots-2.1.0.tgz","hashes":{"sha1":"3c59ec82db458a3508f8dd92d6de0c4b5b0e8c37","sha512_sri":"sha512-EFUz+/2XP6NjcucR41AG6q8nIJDAZKCxCA5JCgPe1r9MH/pFamBwIHtLFMPkgecDvqMqdfq/6tTq3tmvELRIkA=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/blots/v/2.1.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/blots/v/2.1.1"}],"database_specific":{"malicious-packages-origins":[{"import_time":"2026-07-29T03:10:39.13469058Z","modified_time":"2026-07-28T13:38:48Z","sha256":"57066a6751b0444f7693ed35561fa24c16c649be8ce94c692b63f0470784866a","source":"ossf-package-analysis","versions":["2.1.0"]},{"id":"IN-MAL-2026-011083","import_time":"2026-08-04T21:33:16.252061904Z","modified_time":"2026-08-04T21:30:06Z","sha256":"6e60effdc9b01c947156ba12242c977a67552eda460c939e41b3545603f45ccf","source":"amazon-inspector","versions":["2.1.0"]},{"id":"IN-MAL-2026-014901","import_time":"2026-08-05T14:19:41.339341246Z","modified_time":"2026-08-05T13:09:00Z","sha256":"847ba592915f4561a16225808a93d2428bc12305dc3df0bbf5316bf5a5bd7518","source":"amazon-inspector","versions":["2.1.1"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"OpenSSF: Package Analysis","contact":["https://github.com/ossf/package-analysis","https://openssf.slack.com/channels/package_analysis"],"type":"FINDER"}]}