zeal-rq-hooks

{"modified":"2026-08-11T17:22:07Z","published":"2026-08-11T17:22:07Z","schema_version":"1.7.4","id":"MAL-2026-13742","summary":"Malicious code in zeal-rq-hooks (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (dcf7e926ec85f72f362263a19d4f99c4b215ddd94ed4454c669c3387cacee164)\nThe package includes canary.js which imports os/http/https and, at line 123, POSTs a JSON body containing os.hostname(), os.userInfo(), process.platform, node/npm version, and cwd to the hardcoded endpoint https://npm-canary.aveliscare.com. The hostname is not associated with the npm registry or a documented publisher and is embedded directly in the package's own shipped code. The collected fields (hostname, username, platform, cwd) are host-identifying reconnaissance data, and the network destination is not user-configurable in the flagged code path.\n","affected":[{"package":{"ecosystem":"npm","name":"zeal-rq-hooks"},"versions":["0.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"canary.js","sha256":"313f6afebeb44640d7df7a1995d0958bed918ecf2be8f171d4fbfe8dcab91f1d","tlsh":"acd1d86613f052762b8206b4591f00979736e027722aa170f5af92143f4a6bc87f3deb"}],"package_integrity":[{"filename":"zeal-rq-hooks-0.0.0.tgz","hashes":{"sha1":"ce5a93755c893ec85f8160daf5992369b4e0154b","sha512_sri":"sha512-W7k44IcqJxuqqQA3Y0DTWO8eAeVVfQRu36cM6dYy1qbXmthEjAgToGboUZqxFpMEWWgihEoLrcA8KfuiSoxEmw=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/zeal-rq-hooks/v/0.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-017374","import_time":"2026-08-11T17:24:19.528788019Z","modified_time":"2026-08-11T17:22:07Z","sha256":"dcf7e926ec85f72f362263a19d4f99c4b215ddd94ed4454c669c3387cacee164","source":"amazon-inspector","versions":["0.0.0"]}]}}