preinstall-hook-webhook-callback-demo

{"modified":"2026-08-13T22:22:32Z","published":"2026-08-13T21:54:42Z","schema_version":"1.7.4","id":"MAL-2026-14016","summary":"Malicious code in preinstall-hook-webhook-callback-demo (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (d6e707d55368c2628038e0efaac35629fba6dbd520e66a7e29f9c6a86c69b2e1)\npackage.json declares a preinstall lifecycle script that contacts webhook.site, an ephemeral request-capture service commonly used as an attacker-controlled exfiltration sink. The hook fires automatically on `npm install` before any user interaction, and webhook.site is not a first-party or documented destination for any legitimate build or runtime purpose of this package. The combination of an auto-executing preinstall script wired to an out-of-band capture endpoint is the shape of installer-side data exfiltration / callback beaconing at install time.\n","affected":[{"package":{"ecosystem":"npm","name":"preinstall-hook-webhook-callback-demo"},"versions":["1.0.1","1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"package.json","sha256":"44457e693878895b1248648ee589ad6cb57f43d29f8fad37a95d66b588a02751","tlsh":"e8017b38ca12a93128d49bf50a17414712a1882b4a603d49b7cb417d8f5f61f44bf31f"}],"package_integrity":[{"filename":"preinstall-hook-webhook-callback-demo-1.0.1.tgz","hashes":{"sha1":"16188ac17c7f5c51f20ebc99a2893f521f94fe26","sha512_sri":"sha512-SehacCDUJu+kGoZm4vn9Y0nws861XTISgJ8IOvbSQJ5ey03kRB7PBqdbHJysUK//KnpQryDHMMClmMNL/4Y8Kg=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/preinstall-hook-webhook-callback-demo/v/1.0.1"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/preinstall-hook-webhook-callback-demo/v/1.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-017712","import_time":"2026-08-13T22:20:21.59739106Z","modified_time":"2026-08-13T21:54:55Z","sha256":"037c89bf149ea8deefcf9cba562b080ad8046120e0b9f722a66b61af58c2f4ef","source":"amazon-inspector","versions":["1.0.1"]},{"id":"IN-MAL-2026-017711","import_time":"2026-08-13T22:20:21.500983972Z","modified_time":"2026-08-13T21:54:42Z","sha256":"d6e707d55368c2628038e0efaac35629fba6dbd520e66a7e29f9c6a86c69b2e1","source":"amazon-inspector","versions":["1.0.0"]}]}}