@secauditb20y/sec-test-r3b

{"modified":"2026-08-13T21:23:10Z","published":"2026-08-13T21:23:10Z","schema_version":"1.7.4","id":"MAL-2026-13989","summary":"Malicious code in @secauditb20y/sec-test-r3b (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (df7034b94531c8be5e9141c7a5cf73f552486c1b307672346a0e646e60207b7c)\npackage.json declares a postinstall script that runs `node -e` to invoke fs.writeFileSync, creating /tmp/PWN_R3REAL/FIRED on the installer's machine when the package is installed. The package's main module only exports the literal value 42 and ships no native build or legitimate reason for install-time execution; the postinstall exists solely to demonstrate arbitrary code execution on the installer host at `npm install` time. The behavior fires automatically on default install and writes to a path outside the package directory, matching the shape of a proof-of-execution beacon. The package name and description self-identify as an authorized security test, but self-labeling is not a mitigation and the code path is functionally identical to a dropper marker.\n","affected":[{"package":{"ecosystem":"npm","name":"@secauditb20y/sec-test-r3b"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"package.json","sha256":"ab342eb7ca5411389931088dec31d592ac3b5319ccee93b8e50e4ff3bf7f95ad","tlsh":"35e07d240e50533338c4467615b6d50a66a1cc2b0004740447c7206951cebb79bbbb0d"}],"package_integrity":[{"filename":"sec-test-r3b-1.0.0.tgz","hashes":{"sha1":"b61fbcce4a59bfae417b8280c35498ea3ff70ed6","sha512_sri":"sha512-qGwpSVqg8lA8Xk6rNsjOSyMPjVn/jFe/6eQlKT0YuQHyIbTsymZn74SAjYqMDeVY8r2ztCjQOU7wS/R5XC6cYA=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@secauditb20y/sec-test-r3b/v/1.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-017707","import_time":"2026-08-13T21:50:19.940159105Z","modified_time":"2026-08-13T21:23:10Z","sha256":"df7034b94531c8be5e9141c7a5cf73f552486c1b307672346a0e646e60207b7c","source":"amazon-inspector","versions":["1.0.0"]}]}}