store-locator-widget

{"modified":"2026-08-05T13:10:37Z","published":"2026-08-05T13:10:37Z","schema_version":"1.7.4","id":"MAL-2026-12804","summary":"Malicious code in store-locator-widget (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (1b2ffc9f3972c8313fe78eaac2412cc8e46a693d149404736a089a18596ff7f5)\nstore-locator-widget@9999.0.0 ships an empty library body (index.js exports `{}`) and a preinstall hook (`node callback.js`) that, on `npm install`, collects the installer's hostname, username, current working directory, configured npm registry, and CI project-slug environment variables (GITHUB_REPOSITORY, CI_PROJECT_PATH, BUILD_REPOSITORY_NAME, and similar) and transmits them as query-string parameters via HTTP GET to a hardcoded bare-IP endpoint at http://75.119.137.232:31337/depconfuse. The version number 9999.0.0, the placeholder description, the empty module body, and the `/depconfuse` URL path together match the dependency-confusion reconnaissance probe pattern: the package delivers no advertised functionality and its sole install-time effect is to leak information about the installer's internal package namespace and build environment to an attacker-controlled destination.\n","affected":[{"package":{"ecosystem":"npm","name":"store-locator-widget"},"versions":["9999.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"callback.js","sha256":"fd072754fe395d3754541d4cad41f6dcc852d2bfc7bc166359c6c85561fc75fb","tlsh":"97117bb9c68c0c3409c21784b9696c1eb8fbd29133c294917f2d71d26bb22b446b75b9"},{"path":"package.json","sha256":"990a2ecd70093a1926f9ae43290c9521020587e2eb9dc818574dc0d5dbe38aa3","tlsh":"50d02b30aa1248332cc4ebd24c17054211628e1b010438192b47501d05a826b15bf24d"}],"package_integrity":[{"filename":"store-locator-widget-9999.0.0.tgz","hashes":{"sha1":"3e5f0b997380487aa9ef71695e5795d219b530b4","sha512_sri":"sha512-bxrJvhQlsN8l1mMTuybmQT/q/d+aXzjWr5YvDId5SPV0QIygEoxiMtreEgqbyPrnwUe947nIr9HrC80jphPMww=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/store-locator-widget/v/9999.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-014913","import_time":"2026-08-05T14:19:42.426884441Z","modified_time":"2026-08-05T13:10:37Z","sha256":"1b2ffc9f3972c8313fe78eaac2412cc8e46a693d149404736a089a18596ff7f5","source":"amazon-inspector","versions":["9999.0.0"]}]}}