tfjs-custom-module

{"modified":"2026-08-19T01:17:36Z","published":"2026-08-19T01:17:36Z","schema_version":"1.7.4","id":"MAL-2026-14196","summary":"Malicious code in tfjs-custom-module (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (c50d87a4593cb5a0444f2333f368180b64dfb5d3b8f37e0baf4f6d686ea2ef74)\ntfjs-custom-module is a typosquat of the tensorflow/tfjs package. Its package.json declares a postinstall lifecycle script that runs automatically on npm install. The script collects installer host identifiers — os.hostname(), process.platform, process.arch, process.version, package name, and the npm lifecycle event — and POSTs them as JSON via https.request to the hardcoded external host 8xq4kw5d.instances.poc.jchunt.top at path /tfjs-custom-module. The endpoint is not the installer's infrastructure and the beacon is not opt-in. This is host-reconnaissance exfiltration to an author-controlled destination running under a look-alike canary domain, regardless of any self-labeling as security research.\n","affected":[{"package":{"ecosystem":"npm","name":"tfjs-custom-module"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"postinstall.js","sha256":"9cba5ad6cbbed6c0f2a870164148e4f38052c8bbf30ce86deaff41445dd50d27","tlsh":"6501fed5d1f9563127f8628068e0af0697fbf223370624f67ac448a92f8d0f900311ac"}],"package_integrity":[{"filename":"tfjs-custom-module-1.0.0.tgz","hashes":{"sha1":"1ba97085ddfec4912e3813ebba80eb47cadcccf4","sha512_sri":"sha512-+BLJms4CkwN5x2+iq3pZi1vjN+yiT6fC2lcDPSMYNfFi2KfT9W2i+ghxinwxh7QSZeeGklTcQN4KSluD9DreOg=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/tfjs-custom-module/v/1.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-018278","import_time":"2026-08-19T01:34:41.859795494Z","modified_time":"2026-08-19T01:17:36Z","sha256":"c50d87a4593cb5a0444f2333f368180b64dfb5d3b8f37e0baf4f6d686ea2ef74","source":"amazon-inspector","versions":["1.0.0"]}]}}