greatcall-customers-commandapi

{"modified":"2026-08-05T01:44:04Z","published":"2026-08-05T01:44:04Z","schema_version":"1.7.4","id":"MAL-2026-12065","summary":"Malicious code in greatcall-customers-commandapi (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (a2e378b27f75da210578cf8a4102023d3cbf2ab7e96a97267d73c6ffa15500c9)\ngreatcall-customers-commandapi@99.0.0 is a dependency-confusion attack package. package.json self-describes as \"Dependency confusion PoC\" and declares preinstall, install, and postinstall lifecycle scripts all invoking `node index.js`. On any of the three install hooks, index.js collects host identifiers (os.hostname(), os.userInfo(), homedir, platform, cwd, network interfaces), captures the output of `whoami` and `ls -la` via child_process.execSync, and enumerates process.env filtering for credential-shaped keys matching /KEY|SECRET|TOKEN|PASS|AUTH|CRED|PRIVATE|AWS_|AZURE_|GCP_|GITHUB|NPM|DB_|DATABASE|API|WEBHOOK|JENKINS|OCTOPUS|CONNECTION/i, then POSTs the collected payload to a hardcoded webhook at https://test.v3n.my/pwn via https.request. The 99.0.0 version and internal-sounding name are the canonical dependency-confusion shape used to override a private registry package of the same name.\n","affected":[{"package":{"ecosystem":"npm","name":"greatcall-customers-commandapi"},"versions":["99.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"f7bff4ab188e65ee22d349cecfcaa201b45d224444de4a8d141cfd8d17619331","tlsh":"c52112f1a2e5a7b039b398d068436022a663c5173c16b8a0799c56541f8d5a881f15f9"},{"path":"package.json","sha256":"8e1771e385b9d924e8e8054f55ffb43dfd20dfa86fbfc5223e598d7584214093","tlsh":"c1e026309c30593328d42bd44c7b520415728e7b0444b8093ad7201cc6df22a45ff32d"}],"package_integrity":[{"filename":"greatcall-customers-commandapi-99.0.0.tgz","hashes":{"sha1":"b67ce92115370161d97ee76c5d3008ef3130b261","sha512_sri":"sha512-qPy/sSKpuCWnd3Lv2oBio6jexqOQR4Af045opR1K6nfeaHekVG/BOaNTh283LsokKyffGufNVhB1OZHbwBtn3w=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/greatcall-customers-commandapi/v/99.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-011519","import_time":"2026-08-05T03:11:16.891016486Z","modified_time":"2026-08-05T01:44:04Z","sha256":"a2e378b27f75da210578cf8a4102023d3cbf2ab7e96a97267d73c6ffa15500c9","source":"amazon-inspector","versions":["99.0.0"]}]}}