dc-renewals-layout2

{"modified":"2026-08-05T13:19:02Z","published":"2026-08-05T13:19:02Z","schema_version":"1.7.4","id":"MAL-2026-12671","summary":"Malicious code in dc-renewals-layout2 (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (6219fbfa414c89e001a734c3cdebf2c059981f1777c937f513198c21e3cbd113)\nThe package's preinstall script auto-runs on npm install and issues a plaintext HTTP GET to http://75.119.137.232:31337/depconfuse carrying the installer's hostname, username, current working directory, configured npm registry, and CI repository slug environment variables as query parameters. The 9999.0.0 version combined with the /depconfuse endpoint path is the fingerprint of a dependency-confusion reconnaissance beacon: the CI repository slug reveals the names of the installer's private internal packages/repos, which enables targeted follow-on dependency-confusion attacks against the installer's organization. The destination is a hardcoded bare IP on a non-standard port with no relation to the package's declared purpose.\n","affected":[{"package":{"ecosystem":"npm","name":"dc-renewals-layout2"},"versions":["9999.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"callback.js","sha256":"4266edee3091b25a6a5f5038deddd0bbfe587a8d01ad0b9377fc20cecea34b07","tlsh":"9f117fb9c68c1c3419c2178479696c1eb8fbd29133c294917f2d71d267b227446b71bd"}],"package_integrity":[{"filename":"dc-renewals-layout2-9999.0.0.tgz","hashes":{"sha1":"26e73a8109c2789b01127f617dbda531bad52ffb","sha512_sri":"sha512-QPXcpa5kw7ft2Bhc7mlTdkXzzT/n0cUmKDnqvEsroYDGLbJH7moRHM/8voLeibLwxApdYDgE6zRKkDuGX7iyEg=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/dc-renewals-layout2/v/9999.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-014970","import_time":"2026-08-05T14:19:47.980258207Z","modified_time":"2026-08-05T13:19:02Z","sha256":"6219fbfa414c89e001a734c3cdebf2c059981f1777c937f513198c21e3cbd113","source":"amazon-inspector","versions":["9999.0.0"]}]}}