functions-framework-nodejs

{"modified":"2026-08-13T17:21:06Z","published":"2026-08-13T17:21:06Z","schema_version":"1.7.4","id":"MAL-2026-13951","summary":"Malicious code in functions-framework-nodejs (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (d4c9e327ae7e806fc6d270807180963349c0b7578b69f31336780d87323fdafa)\nPackage `functions-framework-nodejs` is a typosquat of Google's `@google-cloud/functions-framework`. Its package.json declares `postinstall: node install.js`, and install.js runs `execSync(\"id\")` on the installer's host, then POSTs the captured Unix user/group identity (with package name, version, and timestamp) to a hardcoded webhook.site collector URL. The advertised library surface (index.js) is a trivial stub exporting only name and version — the package's sole functional effect on install is the identity exfiltration. Package metadata self-labels as \"For Security Research\" by author \"Berserk\"; that label does not change the behavior: on `npm install`, installer-side host identity is sent to a third-party endpoint the installer did not configure.\n","affected":[{"package":{"ecosystem":"npm","name":"functions-framework-nodejs"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"install.js","sha256":"30d96bfb7b69b8df81e6fca2165f27b2fb6d1a99a056be6a0fc0e43e301c6381","tlsh":"171102ae55f02b3061f5e4d0b4668844a4e3d213f50dbcd475cd07641f8d8e910727ee"},{"path":"package.json","sha256":"2aafc6045d7cbb6ca1d5d936275cd0c7479f9978c343668514f9013cfd73a47e","tlsh":"81d0a7181c25aa3368c05eb50927910a76b19d5b1054fc0c27a7119893efbfa44bf75f"}],"package_integrity":[{"filename":"functions-framework-nodejs-1.0.0.tgz","hashes":{"sha1":"d3b39874019dc0cfb6c0177eb2de1cb1ceb9bb90","sha512_sri":"sha512-8K8HPfLucxSnyys79CWgvKR9izwZaoIkukKN2yZIT5boF+iFlVCcXUTom6/u3DhvOelOkpuOJbhxIdWVkSlc1A=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/functions-framework-nodejs/v/1.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-017653","import_time":"2026-08-13T17:24:46.078743903Z","modified_time":"2026-08-13T17:21:06Z","sha256":"d4c9e327ae7e806fc6d270807180963349c0b7578b69f31336780d87323fdafa","source":"amazon-inspector","versions":["1.0.0"]}]}}