gaarf-node-bq

{"modified":"2026-08-19T03:48:45Z","published":"2026-08-19T03:48:45Z","schema_version":"1.7.4","id":"MAL-2026-14239","summary":"Malicious code in gaarf-node-bq (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (1f61e7b586146a833e50d74ccdff68942b4514f66c38beca981d2ead87761633)\ngaarf-node-bq is a dependency-confusion / typosquat canary targeting the internal google/ads-api-report-fetcher (`gaarf`) package. The bin entry is an empty noop and the package ships no real functionality. Its postinstall lifecycle script collects host identifiers (os.hostname(), platform, arch, node version, package name, npm lifecycle event) and POSTs them as JSON to the hardcoded endpoint https://yu7pug2j.instances.poc.jchunt.top/gaarf-node-bq. Any installer that mis-resolves the private name to the public registry has its host metadata sent to that endpoint without consent at install time.\n","affected":[{"package":{"ecosystem":"npm","name":"gaarf-node-bq"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"postinstall.js","sha256":"07d63284a6d4ccbf9da384f0d89af2a96e5fffaa840fe178262ce0582d48b13d","tlsh":"fb0123d1d1b5567527f8628028f0af0793fbf223370624b679c444e92f8d4f9403119c"},{"path":"source.txt","sha256":"d82398aee4b983232984133606db31c08bba1c50ab487af74ebdfb1c3a45a7c1","tlsh":"83b0127a208dd2330e10aabf57b8a164b81a6560bc70f9dd95198bd8730a464c2a7046"}],"package_integrity":[{"filename":"gaarf-node-bq-1.0.0.tgz","hashes":{"sha1":"6d1d2d5a7ea1aa1284b92924aebcb63cdf00eef8","sha512_sri":"sha512-fqiv/zVIX8qx9gnYV/EJY71/yyol8UwfFJ3N5sAyHCqWXeh7FG45z1fOJfJSmMF2YOzTSV8wtE1uuZNo/00l5g=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/gaarf-node-bq/v/1.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-018340","import_time":"2026-08-19T03:49:31.139999681Z","modified_time":"2026-08-19T03:48:45Z","sha256":"1f61e7b586146a833e50d74ccdff68942b4514f66c38beca981d2ead87761633","source":"amazon-inspector","versions":["1.0.0"]}]}}