titan-exchange-shared-permissions

{"modified":"2026-08-08T00:52:01Z","published":"2026-08-08T00:52:01Z","schema_version":"1.7.4","id":"MAL-2026-13664","summary":"Malicious code in titan-exchange-shared-permissions (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (248b317decf11a421474c727d9b8f543330eab17a65b31adf91f4083782025b6)\ntitan-exchange-shared-permissions@99.9.9 is a dependency-confusion reconnaissance package. package.json declares a postinstall script (`node index.js`) that runs automatically on `npm install`; index.js collects the installer's OS username (os.userInfo().username), hostname (os.hostname()), current working directory, and non-internal IPv4 address (from os.networkInterfaces()) and POSTs them as JSON via https.request to the hardcoded collector https://webhook.site/452b7e38-183d-4652-847d-0f2fa05b9389. The package name is styled to resemble a private internal scope, is published at version 99.9.9, and ships with empty description/author/license and no other functionality — the canonical namesquat/dependency-confusion probe shape used to identify build systems that resolve a private name to the public registry.\n","affected":[{"package":{"ecosystem":"npm","name":"titan-exchange-shared-permissions"},"versions":["99.9.9"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"dfbe84616bd17c7face74fa85caa3edf3c54163331e96e3009717837407aecb3","tlsh":"a501f4f5517bf5740e6813e1d805ec0de763e121700595e05628c3ec6bd69f41670d9c"},{"path":"package.json","sha256":"a183c41e4efaafed57b8f7d2422115b7a5c0d80d9d308730a97d1a38f78d4022","tlsh":"2ed023305d14673368c8069d4c7b740675a14d1f010c341d4793542890ef97348ff31e"}],"package_integrity":[{"filename":"titan-exchange-shared-permissions-99.9.9.tgz","hashes":{"sha1":"f6a0bccc56cb491aef85168e2a4c4767227bc636","sha512_sri":"sha512-psaLwuosIa0HlXl32dwmCp5DZcT8WDdctaRHmhEEstaxJ4oHANpMbBM8DRTe4XhxEtZ4uUSKQw5TXM+manI7lA=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/titan-exchange-shared-permissions/v/99.9.9"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-017196","import_time":"2026-08-08T00:53:09.991992004Z","modified_time":"2026-08-08T00:52:01Z","sha256":"248b317decf11a421474c727d9b8f543330eab17a65b31adf91f4083782025b6","source":"amazon-inspector","versions":["99.9.9"]}]}}