stretchshop

{"modified":"2026-08-06T15:34:27Z","published":"2026-08-06T15:34:27Z","schema_version":"1.7.4","id":"MAL-2026-13460","summary":"Malicious code in stretchshop (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (479c1238e6380db5463eb3755b980f963d269b2b0874d464b9e1b3b65bd03f60)\npackage.json declares a postinstall hook that runs `node demo/demo.js base`, which shell-invokes `git clone https://github.com/Wradgio/StretchShop-demo-data.git` at mutable HEAD (no commit SHA, no tag, no integrity check) and then `childProcess.fork`s `db/demo_data.js` from the freshly cloned tree. The cloned repository is owned by the personal GitHub account `Wradgio`, which does not match the package's publisher scope `StretchShop`. Whoever controls that GitHub account can push arbitrary JavaScript to the default branch and have it executed on every fresh top-level install of stretchshop@0.7.5.\n","affected":[{"package":{"ecosystem":"npm","name":"stretchshop"},"versions":["0.7.5"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"demo/demo.js","sha256":"f9d9f5c071ef5a76e0e379db50a96b4c5fc5511c639912d09175317d87c19f9a","tlsh":"e69176435bcc072475e42657bc16099b11ed82b1e8b07d1898ddc9f631a78ec664eeb2"}],"package_integrity":[{"filename":"stretchshop-0.7.5.tgz","hashes":{"sha1":"c13ad6b55e44ff8862790baa43fd06c38b764236","sha512_sri":"sha512-2314vzjdcvwgVJa3KyxcmHcVuMpthLLN6EA4dQN/4wTvga9szP9w/YnisjR3k1ehujp/Z9ZXjsS0xSeC7mc3bA=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/stretchshop/v/0.7.5"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-016653","import_time":"2026-08-06T18:09:01.76413629Z","modified_time":"2026-08-06T15:34:27Z","sha256":"479c1238e6380db5463eb3755b980f963d269b2b0874d464b9e1b3b65bd03f60","source":"amazon-inspector","versions":["0.7.5"]}]}}