test22221

{"schema_version":"1.7.4","id":"MAL-2026-12478","published":"2026-08-05T12:44:50Z","modified":"2026-09-24T09:23:29.384384466Z","summary":"Malicious code in test22221 (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (e4a3401759b5c6d7effdafcbae6027657e3cf8f9aabf1f04dfc2fa9039b64e53)\npackage.json declares preinstall and postinstall lifecycle hooks that run on `npm install`. Both hooks curl a hardcoded bare-IP endpoint over plain HTTP at 54.37.234.136, sending the installer's username (`whoami`), hostname, current working directory, and a timestamp as query-string parameters to `http://54.37.234.136/voicemail`. The same lifecycle scripts also embed an unbounded `for((i=1;;i++))` loop that repeatedly curls incrementing paths on the same host with a 10-second sleep, functioning as a long-poll channel to the attacker-controlled endpoint during install. The destination is a bare IP with no relationship to any package publisher domain, and the collected fields are host-identification data with no legitimate purpose in an install hook.\n","affected":[{"package":{"name":"test22221","ecosystem":"npm"},"versions":["2.2.7","2.2.8","2.2.9"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"package.json","sha256":"a0b87bbb02973582b409e66d9f3281c35567abd5c854a3a02fcab50ee48a2d9e","tlsh":"0af09e5c9825ae733bc0831c3c95c30bb5816ef79158bc1aaf030c49288c176607a36b"}],"package_integrity":[{"filename":"test22221-2.2.7.tgz","hashes":{"sha1":"41fed083fdc48702f82661043c48784d23b41200","sha512_sri":"sha512-f4gbJCquvC2lPJva9eGR33Kjg1lqr+JNUyw0l+3sHvbLMezdG+o2yxrECoOmIPTaWPQZPIRq+bW+ogYj+zXLjg=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/test22221/v/2.2.7"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/test22221/v/2.2.8"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/test22221/v/2.2.9"}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-014868","import_time":"2026-08-05T13:08:52.02623016Z","modified_time":"2026-08-05T13:03:58Z","sha256":"a44fe0c6ead0b2a6bb04d0b5e3b533495b68798d43c99f3ba0de9f7602687f66","source":"amazon-inspector","versions":["2.2.7"]},{"id":"IN-MAL-2026-014752","import_time":"2026-08-05T13:08:43.624852628Z","modified_time":"2026-08-05T12:46:03Z","sha256":"e3cbc7d139320187d95a6264959f8d4a2a6688fa6140bc8bc43e2fba0110914f","source":"amazon-inspector","versions":["2.2.8"]},{"id":"IN-MAL-2026-014744","import_time":"2026-08-05T13:08:42.770916845Z","modified_time":"2026-08-05T12:44:50Z","sha256":"e4a3401759b5c6d7effdafcbae6027657e3cf8f9aabf1f04dfc2fa9039b64e53","source":"amazon-inspector","versions":["2.2.9"]},{"id":"RLMA-2026-10797","import_time":"2026-09-24T09:21:35.813310758Z","modified_time":"2026-09-22T17:42:33Z","sha256":"f0b1d9a9ac9b91da2ebc8f000a9c724a1380ba91a85620c64353193370c20689","source":"reversing-labs","versions":["2.2.7","2.2.8","2.2.9"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"ReversingLabs","contact":["https://www.reversinglabs.com"],"type":"FINDER"}]}