pilgrimage-portal-client

{"modified":"2026-08-06T16:22:23Z","published":"2026-08-06T16:22:23Z","schema_version":"1.7.4","id":"MAL-2026-13453","summary":"Malicious code in pilgrimage-portal-client (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (73b9f604c074795de9d79071f9e8a6c131e0a30159f6ea2a0769ded3df6d5a28)\nOn `npm install`, the package's postinstall hook runs `node ping.js`, which reads the installer's hostname via `require('os').hostname()` and POSTs it, along with a timestamp and the package name/version, to the hardcoded bare-IP endpoint http://134.119.222.10:9009/canary over plain HTTP. Errors and timeouts are silently swallowed. The version number (99.0.0) and beacon shape are consistent with a dependency-confusion proof-of-install callback: the destination is a non-first-party bare IP the installer never configured, and the outbound call fires automatically without user consent. Regardless of the 'canary' self-label, host-identifier data leaves the installer's machine to an attacker-controlled endpoint at install time.\n","affected":[{"package":{"ecosystem":"npm","name":"pilgrimage-portal-client"},"versions":["99.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"ping.js","sha256":"585e5dc0ccdb08b9d887f8159d49a63d2e7467184a35c9e7923627705beaaecf","tlsh":"2cf002e552e0f6262df5f2c0f0f5980b4331e021f71b68e0d6c913157a8c6a967b75d0"}],"package_integrity":[{"filename":"pilgrimage-portal-client-99.0.0.tgz","hashes":{"sha1":"a13608f4df73c887187256fb4fcb1858cd7bff81","sha512_sri":"sha512-iR3YIZ5nCgbznW0gm8io4WF9DTMjWQgONk3qMDgj6qaFtaV+bdNIi9eRd1p6dEtsZzercsX2GR1eRaaa11cIhA=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/pilgrimage-portal-client/v/99.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-016681","import_time":"2026-08-06T18:09:05.465823142Z","modified_time":"2026-08-06T16:22:23Z","sha256":"73b9f604c074795de9d79071f9e8a6c131e0a30159f6ea2a0769ded3df6d5a28","source":"amazon-inspector","versions":["99.0.0"]}]}}