editor_application

{"modified":"2026-08-05T13:17:36Z","published":"2026-08-05T13:17:36Z","schema_version":"1.7.4","id":"MAL-2026-12788","summary":"Malicious code in editor_application (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (c5914405fc5126f1abcc621e835b7e71774fb1b49cc51d5f02e808292769eb25)\npackage.json declares a preinstall hook that runs `node callback.js`, which on `npm install` collects host-level identifiers (os.hostname, os.userInfo username, current working directory, npm_config_registry) and private CI repository slugs from a broad set of provider env vars (GITHUB_REPOSITORY, GitLab, Azure, Bitbucket, Travis, Drone, Buildkite, Circle, Jenkins) and transmits them via plain-HTTP GET to http://75.119.137.232:31337/depconfuse as query parameters (pkg, h, u, d, reg, ci). The version number 9999.0.0 combined with the `/depconfuse` path is the signature of a dependency-confusion beacon that maps internal package namespaces and CI topology of installing organizations to a hardcoded attacker-controlled bare-IP endpoint.\n","affected":[{"package":{"ecosystem":"npm","name":"editor_application"},"versions":["9999.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"callback.js","sha256":"00b7cf6378da166a1054ad9895f53e9937dd3d53e086c01e2f2b3063b31c99ee","tlsh":"2a117bb9c68c0c3409c21784b9686c5eb8fbd29233c294917f2d71d26bb227046b71f9"}],"package_integrity":[{"filename":"editor_application-9999.0.0.tgz","hashes":{"sha1":"3fa84fd6e6fd73fa694cc2d42f0931e3307b1ca1","sha512_sri":"sha512-nqi8yifEMO5SrRi6Ozgp8pxeo8w1lrC6WElMWnzADKLi2EeDVP/OoMT6cv8xlQF90PsY9tBMxviTmdL9Qmr1Lw=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/editor_application/v/9999.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-014960","import_time":"2026-08-05T14:19:47.00495852Z","modified_time":"2026-08-05T13:17:36Z","sha256":"c5914405fc5126f1abcc621e835b7e71774fb1b49cc51d5f02e808292769eb25","source":"amazon-inspector","versions":["9999.0.0"]}]}}