@web-monorepo/fetchers

{"modified":"2026-03-23T05:16:25Z","published":"2026-03-10T08:31:27Z","schema_version":"1.7.4","id":"MAL-2026-1318","summary":"Malicious code in @web-monorepo/fetchers (npm)","details":"Package is malware. It exfiltrates data to a suspicious domain via callback.js, triggered by a preinstall script in package.json.\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (a3faaa666cb666785670b3a638b1f832d4492f7eb2c999f41f7bb551cde2aa86)\nThe package @web-monorepo/fetchers was found to contain malicious code.\n","affected":[{"package":{"ecosystem":"npm","name":"@web-monorepo/fetchers"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}]}],"references":[{"type":"REPORT","url":"https://app.safedep.io/community/malysis/01KK3ARTMK1RXWTT6A7T2KTKER"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["actran@amazon.com"]},{"name":"SafeDep","type":"FINDER","contact":["https://safedep.io"]}],"database_specific":{"malicious-packages-origins":[{"source":"amazon-inspector","sha256":"a3faaa666cb666785670b3a638b1f832d4492f7eb2c999f41f7bb551cde2aa86","import_time":"2026-03-23T05:14:02.9604562Z","modified_time":"2026-03-23T05:11:41Z","ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}]}]}}