chapters-core

{"modified":"2026-08-11T18:50:36Z","published":"2026-08-11T18:50:36Z","schema_version":"1.7.4","id":"MAL-2026-13752","summary":"Malicious code in chapters-core (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (e24d8bd29ee6c23e0f394b68bbc5b580614da4479a2462c10d61387da464b992)\nThe package registers preinstall/postinstall lifecycle scripts that execute poc.js on npm install. poc.js collects os.hostname(), os.userInfo().username, process.cwd(), and CI/CD attribution environment variables (GITHUB_REPOSITORY, GITHUB_ACTOR, GITHUB_RUN_ID, RUNNER_NAME, npm_config_registry, AWS_REGION, JENKINS_URL, and similar) and transmits them via DNS lookups and HTTP/HTTPS POST to a hardcoded Interactsh callback subdomain awfhvaksncnsxtcdjvmnhhqbt59dzenf8.oast.fun. The package name chapters-core at version 9.999.999 is shaped as a dependency-confusion squat of an internal package name, and poc.js additionally writes a marker file samsung-depconf-poc.json into the caller's working directory. Any self-labeling of the file as research does not alter the observed behavior: install-time collection of installer host identity and internal build-environment attribution and transmission to a hardcoded, non-first-party destination.\n","affected":[{"package":{"ecosystem":"npm","name":"chapters-core"},"versions":["9.999.999"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"poc.js","sha256":"b23864601e7f0138e62f91cb4bd7aeb0c1bef51073705abc49e161a4ed813176","tlsh":"b291855f4498156016e3b66a119f101630e7d7fa0296fae9f00d535e0ff87e9023ada9"}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/chapters-core/v/9.999.999"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-017389","import_time":"2026-08-11T18:52:01.718049926Z","modified_time":"2026-08-11T18:50:36Z","sha256":"e24d8bd29ee6c23e0f394b68bbc5b580614da4479a2462c10d61387da464b992","source":"amazon-inspector","versions":["9.999.999"]}]}}