fastly-vcl-language-client

{"modified":"2026-08-15T15:57:38Z","published":"2026-08-15T15:57:38Z","schema_version":"1.7.4","id":"MAL-2026-14060","summary":"Malicious code in fastly-vcl-language-client (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (2f77be5ce1488e7867223b63fd5c90060e98d6a44325ff2f71bed2b61653d649)\nThe package declares scripts.preinstall = 'node vishu.js', which runs unconditionally on npm install. vishu.js fetches the installer's public IP via api.ipify.org, reads os.hostname(), and collects CI runner environment variables (CI, GITHUB_ACTIONS, GITHUB_WORKFLOW, GITHUB_RUN_ID, GITHUB_RUN_NUMBER, GITHUB_RUN_ATTEMPT) from process.env, then POSTs/GETs the collected data to a hardcoded https://webhook.site/3c201be4-c16d-4e0c-bf9c-ccc50faa8574 endpoint. It additionally performs a DNS lookup of ping-<hostname>.<oast-collaborator-domain> to exfiltrate the hostname via DNS out-of-band. The package ships no real functionality — its metadata describes it as a 'dependency test utility package' and its name resembles an internal Fastly tool, consistent with a dependency-confusion / recon probe targeting build systems that resolve internal package names against public npm.\n","affected":[{"package":{"ecosystem":"npm","name":"fastly-vcl-language-client"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"vishu.js","sha256":"2010719c38b757732676ea9129b3bd2768e3a7d0f26cfc10e16f1979c277af83","tlsh":"d931224db2f7965004f263c8561b951f715be1533329dd917a9c02521faad3882f3bdc"},{"path":"package.json","sha256":"a32b3d3e4706124090ebcbbf65d6bbfe436ce263965c537baec981031b43455a","tlsh":"dce0c2344a11a63766c44a921e66904666648f6f11447c086bdb152c419f7b788bf31d"}],"package_integrity":[{"filename":"fastly-vcl-language-client-1.0.0.tgz","hashes":{"sha1":"accc0ae35477a4f8bef3a35b4cf1468e05d45a44","sha512_sri":"sha512-vcjtIfaHVxbgEyFATqt5JojiT4SSCHBv6cJn2Pgzy/UgdUSX+DQTYWn7EqBxEVBh4CI4JcUYvi60u7Tjpq1T7g=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/fastly-vcl-language-client/v/1.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-017959","import_time":"2026-08-15T16:07:56.659295273Z","modified_time":"2026-08-15T15:57:38Z","sha256":"2f77be5ce1488e7867223b63fd5c90060e98d6a44325ff2f71bed2b61653d649","source":"amazon-inspector","versions":["1.0.0"]}]}}