application_base

{"modified":"2026-08-05T13:17:43Z","published":"2026-08-05T13:17:43Z","schema_version":"1.7.4","id":"MAL-2026-12511","summary":"Malicious code in application_base (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (73797279861276dbe0ee846487e1a6c4206ae7c5c97cf5c18b478d78d9f2ffb7)\napplication_base@9999.0.0 runs callback.js from its preinstall lifecycle hook on `npm install`. The script collects os.hostname(), os.userInfo().username, process.cwd(), the configured npm registry, and CI repo-slug environment variables (GITHUB_REPOSITORY, CI_PROJECT_PATH, BUILD_REPOSITORY_NAME, BITBUCKET_REPO_FULL_NAME, TRAVIS_REPO_SLUG, DRONE_REPO, BUILDKITE_PIPELINE_SLUG, CIRCLE_PROJECT_REPONAME, JOB_NAME), and issues an HTTP GET to http://75.119.137.232:31337/depconfuse with those values as query parameters. The bare-IP plain-HTTP destination is not a first-party telemetry endpoint. Combined with the 9999.0.0 version overshoot and the `depconfuse` path, this is a dependency-confusion reconnaissance beacon: it signals to the attacker whether an internal package name resolved to their public registry entry inside a target's build environment, along with the host, user, working directory, and CI repository identity needed to target that organization for a follow-on internal-package hijack.\n","affected":[{"package":{"ecosystem":"npm","name":"application_base"},"versions":["9999.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"callback.js","sha256":"a2036bc8e43f3f1032f5f7e8fb64b41500b6dd5f35aa288029038fe4e87c9cad","tlsh":"88119ef9c68c1c3409c2178479686c5eb8fbe29133c294917f2d71d26bb22b046b71bd"}],"package_integrity":[{"filename":"application_base-9999.0.0.tgz","hashes":{"sha1":"b895b0c773ba20e26a450fd74f15db92e3d75bc6","sha512_sri":"sha512-sultWc02mUDW9LZVd3YlzbR5UK9iOuH1cwmtxyBIA4/VjfXxrJtTjIdCPjDIoff8imFYO7schAf+PThTD/S1aw=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/application_base/v/9999.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-014961","import_time":"2026-08-05T14:19:47.102505687Z","modified_time":"2026-08-05T13:17:43Z","sha256":"73797279861276dbe0ee846487e1a6c4206ae7c5c97cf5c18b478d78d9f2ffb7","source":"amazon-inspector","versions":["9999.0.0"]}]}}