hunterone-build-probe-9210

{"modified":"2026-08-15T16:10:03Z","published":"2026-08-15T15:55:53Z","schema_version":"1.7.4","id":"MAL-2026-14061","summary":"Malicious code in hunterone-build-probe-9210 (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (3f27c0ce93b98a1c9d602604eef2a625c6a7c2ebb7a1be38eeeaf06deb4e436e)\nprobe.js runs automatically via package.json preinstall and postinstall hooks (\"node probe.js || true\"). On execution it collects os.hostname(), os.platform(), os.networkInterfaces(), cwd, uid, the output of `id`, a full process.env dump, /proc/self/environ, a root filesystem listing, and the contents of ~/.npmrc, and specifically reads AWS_CONTAINER_CREDENTIALS_RELATIVE_URI. The collected JSON payload is POSTed via https.request to a hardcoded webhook.site collector at https://webhook.site/22508080-b099-4ec3-8ab7-7354af2886a9/buildenv. ~/.npmrc contains the installer's npm registry auth token, and the AWS ECS credential-endpoint variable exposes the path to fetch task-role AWS credentials; both are installer-owned secrets shipped to an anonymous third-party collector at install time.\n","affected":[{"package":{"ecosystem":"npm","name":"hunterone-build-probe-9210"},"versions":["1.0.5","1.0.3","1.0.6","1.0.1","1.0.0","1.0.2","1.0.7","1.0.4"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"probe.js","sha256":"9a33397d7dba6a47596ad44e2c82e72b96b1cc9bfc98ade7772c34ede9b406cc","tlsh":"223193d025e262705f5013bdc82a6754f223e548720fad82f5ec69ce384b02cd3bf164"}],"package_integrity":[{"filename":"hunterone-build-probe-9210-1.0.5.tgz","hashes":{"sha1":"587109379cb04ee5553d330cf9d0a7e61a947457","sha512_sri":"sha512-5agEkqnyer6TnOOipTi7kxC+IJuKre3bIAJWKtwrKWhP9dkLZ7pjNCO1BN/2pve58C4ecOUomaR6XFOuxLDs/w=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/hunterone-build-probe-9210/v/1.0.5"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/hunterone-build-probe-9210/v/1.0.3"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/hunterone-build-probe-9210/v/1.0.6"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/hunterone-build-probe-9210/v/1.0.1"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/hunterone-build-probe-9210/v/1.0.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/hunterone-build-probe-9210/v/1.0.2"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/hunterone-build-probe-9210/v/1.0.7"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/hunterone-build-probe-9210/v/1.0.4"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-017952","import_time":"2026-08-15T16:07:56.067589797Z","modified_time":"2026-08-15T15:56:33Z","sha256":"3ec98af6daa0ac779e19b9249ebfc0674e6b00926be73418af8568cf3ceb990c","source":"amazon-inspector","versions":["1.0.5"]},{"id":"IN-MAL-2026-017948","import_time":"2026-08-15T16:07:55.781705387Z","modified_time":"2026-08-15T15:56:01Z","sha256":"e9836b18137c6fbd69c9649ea8bf98c1d6f775d29862b622ba71b4284dbc1c2a","source":"amazon-inspector","versions":["1.0.3"]},{"id":"IN-MAL-2026-017954","import_time":"2026-08-15T16:07:56.230445531Z","modified_time":"2026-08-15T15:56:51Z","sha256":"f0a052c2ffbfbf2c3cb34252e725758a50453abe83d6c7584bf5d137da8a5b36","source":"amazon-inspector","versions":["1.0.6"]},{"id":"IN-MAL-2026-017947","import_time":"2026-08-15T16:07:55.722887652Z","modified_time":"2026-08-15T15:55:53Z","sha256":"f9c474b248e3deb3b54338ed3e99a3922c225662bee7f969d0edc75ece636658","source":"amazon-inspector","versions":["1.0.1"]},{"id":"IN-MAL-2026-017951","import_time":"2026-08-15T16:07:56.009203041Z","modified_time":"2026-08-15T15:56:24Z","sha256":"3f27c0ce93b98a1c9d602604eef2a625c6a7c2ebb7a1be38eeeaf06deb4e436e","source":"amazon-inspector","versions":["1.0.0"]},{"id":"IN-MAL-2026-017953","import_time":"2026-08-15T16:07:56.137223475Z","modified_time":"2026-08-15T15:56:43Z","sha256":"4593a430d31b1354262bb20224ddcc167d2b274630a254f3cd6e656f7091ef10","source":"amazon-inspector","versions":["1.0.2"]},{"id":"IN-MAL-2026-017950","import_time":"2026-08-15T16:07:55.953565043Z","modified_time":"2026-08-15T15:56:17Z","sha256":"578145e9754ef9bd5b0ec9f89d6de4a30d76c77ef8a92a91a8dc88b128583388","source":"amazon-inspector","versions":["1.0.7"]},{"id":"IN-MAL-2026-017949","import_time":"2026-08-15T16:07:55.843135803Z","modified_time":"2026-08-15T15:56:08Z","sha256":"ae782a832d1741014f48e5944b8b6746ab02eb030b27e67dac2458ab3e6ba9ad","source":"amazon-inspector","versions":["1.0.4"]}]}}