verify-cli

{"modified":"2026-08-12T14:02:43Z","published":"2026-08-12T14:02:43Z","schema_version":"1.7.4","id":"MAL-2026-13882","summary":"Malicious code in verify-cli (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (081d3a8717b3f05f688cdde25d2b0de315dd9b1f400382e0db00d53f8ca82d6b)\npackage.json declares `preinstall: node index.js`, which runs automatically on `npm install`. index.js shells out via child_process and curl to POST the installer's `whoami`, `hostname`, and `id` output along with base64-encoded contents of `/etc/passwd`, `/etc/hosts`, and (if readable) `/etc/shadow` to a hardcoded out-of-band interactsh/OAST endpoint at `5f8a1ed70fb7761d678agw9bucryyyyyb.oast.site`. Package metadata shows an implausible version (99.0.0), placeholder description (\"Nodejs SDK for Redacted\"), and a nonexistent dependency, consistent with a dependency-confusion / typosquat beacon rather than a legitimate SDK.\n","affected":[{"package":{"ecosystem":"npm","name":"verify-cli"},"versions":["99.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"19d9b30804000e68cb481de23f85e71eb47b3d17d638e8497992885bb69e6ba1","tlsh":"aff0dc8b0df4e83177a5087cdb04541f775bfac45076f35220af4a0c239c488446a1e6"},{"path":"package.json","sha256":"b53011035e240dd841072714498ec44a7f15a5ae8754b271d585176c9a9507eb","tlsh":"d6e08c241d61667325ca16e1886ad447a2a28e6b00087c0966db143c41aebb7a9ff25c"}],"package_integrity":[{"filename":"verify-cli-99.0.0.tgz","hashes":{"sha1":"7465488b926bdcf3e4b7ff619200e1c325275f9e","sha512_sri":"sha512-4SqenxfpfOM7iSHYZwJu77J7cYQwFseJ2ykqkZM93VTFctpXzRgz6UQXvIbZNyAhoShNGiZbUBoj46YMJU4ZCg=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/verify-cli/v/99.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-017574","import_time":"2026-08-12T14:31:16.792975428Z","modified_time":"2026-08-12T14:02:43Z","sha256":"081d3a8717b3f05f688cdde25d2b0de315dd9b1f400382e0db00d53f8ca82d6b","source":"amazon-inspector","versions":["99.0.0"]}]}}