accounts-stores

{"modified":"2026-08-05T09:08:53Z","published":"2026-08-05T09:08:53Z","schema_version":"1.7.4","id":"MAL-2026-12136","summary":"Malicious code in accounts-stores (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (c70d8323b295e6b8dfa18e720a7b6e2a719c42d19a5dedab1157866043417c7d)\nThe package advertises itself as a reactive state-management library but its index.js silently requires./setup at the end of module load inside a try/catch. setup.js schedules a next-tick bootstrap that collects a host fingerprint (os.hostname(), os.userInfo().username, process.cwd(), pid, platform, arch), derives an installId, and loads a ~76KB lib/telemetry.js runtime that POSTs data via https.request. The identifier reads are obfuscated via string-concatenation indirection (os[\"host\"+\"name\"](), os[\"user\"+\"Info\"](), os[\"plat\"+\"form\"](), and a helper const _p=(k)=>os[k]()), which is not consistent with legitimate telemetry SDKs. The destination host is not present as a plain literal in telemetry.js; the file imports dns and https and contains a ServiceDiscovery class that resolves the endpoint at runtime, hiding the exfiltration target from source inspection. Nothing in the advertised state-store API references telemetry, and no opt-in or configuration surface is exposed.\n","affected":[{"package":{"ecosystem":"npm","name":"accounts-stores"},"versions":["0.0.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"48a5b511b15cae43853d652f9c988e50d654ff2cbe1476011064098d7a642906","tlsh":"9b01475237aa696f8474a3a39e3d4167f88bc43505801298b38881dc1fa8c14449dcbc"},{"path":"setup.js","sha256":"56f1fc5a6fce6c48eb1b34a89a8e7d64d8540584f53f22c0977acaeaa3ac71b6","tlsh":"1361115c6ed135260194e3f92a6f804bc99245432ac8ba58be4fb3451f5413983bff6f"},{"path":"lib/telemetry.js","sha256":"eac4233f664fa380839d8492bf8f5b9e2eaf89969a29ebb2572f880df62ce553","tlsh":"6f735055526a642186b2b368df334107ff3685272603429dbafc82dc1fb972092a5ffd"}],"package_integrity":[{"filename":"accounts-stores-0.0.1.tgz","hashes":{"sha1":"dba11c804cf2e65380631db3f2dc60a390d1ec51","sha512_sri":"sha512-7jdabfKv77/KnuqQAQt43UHzKUgGzHGAc3hpELZgk6FjaGHpj9xzn9wP6s6JG09dYSoDp5R1oQHhq32BEinI9w=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/accounts-stores/v/0.0.1"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-014565","import_time":"2026-08-05T09:28:26.114996744Z","modified_time":"2026-08-05T09:08:53Z","sha256":"c70d8323b295e6b8dfa18e720a7b6e2a719c42d19a5dedab1157866043417c7d","source":"amazon-inspector","versions":["0.0.1"]}]}}