remote_session_elements

{"modified":"2026-08-05T13:00:07Z","published":"2026-08-05T13:00:07Z","schema_version":"1.7.4","id":"MAL-2026-12427","summary":"Malicious code in remote_session_elements (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (3a2127d34a7d033e96e00a679891716647f0a00f7590ad738b43d985e83dda69)\nPackage version 9999.0.0 is published with placeholder metadata (\"Shared utility helpers.\", no author) — the canonical shape of a dependency-confusion squat designed to override an internal package of the same name during resolution. On `npm install`, the `scripts.preinstall` hook runs `node callback.js`, which reads `os.hostname()`, `os.userInfo().username`, the current working directory, the configured npm registry, and CI-provided repository identifiers (e.g. `process.env.GITHUB_REPOSITORY`) and sends them via HTTP GET to `http://75.119.137.232:31337/depconfuse?pkg=...`, a hardcoded bare-IP endpoint over cleartext HTTP. This provides an external operator with the internal package name, host identity, and originating CI repository slug of every environment where the squat is installed — reconnaissance for further dependency-confusion attacks against the victim's internal package namespace.\n","affected":[{"package":{"ecosystem":"npm","name":"remote_session_elements"},"versions":["9999.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"callback.js","sha256":"c781ceeb8767f84e07743a932f5cd71881548c90d579cf92cc1fe4fa54ce463b","tlsh":"87119eb9c68c0c340dc2178479696c1eb8fbd29133c294917f2d71d26bb22b046b71bd"},{"path":"package.json","sha256":"e7a8a8c8edb1b0e0d2402b01d0ed1724cfdf0ca398f1d2c6ff25f8fb9d4d6cec","tlsh":"d3d09730ae234c233cd8efd30c3b054611328e2b110838092787802d0aadba728ff28e"}],"package_integrity":[{"filename":"remote_session_elements-9999.0.0.tgz","hashes":{"sha1":"391d5ac8905e80117894c6aca04c5af2cb280a58","sha512_sri":"sha512-f5TCxq4K2qSX9e1CCunpT9NQbaxm4dNLkhFHaRv/RQFmgC38Itu+XhJ9YGN88TgWhHuMkQ9eLp7hySicxYlyyA=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/remote_session_elements/v/9999.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-014842","import_time":"2026-08-05T13:08:50.533989782Z","modified_time":"2026-08-05T13:00:07Z","sha256":"3a2127d34a7d033e96e00a679891716647f0a00f7590ad738b43d985e83dda69","source":"amazon-inspector","versions":["9999.0.0"]}]}}