price-scripping-js

{"modified":"2026-08-19T06:58:53Z","published":"2026-08-19T06:58:53Z","schema_version":"1.7.4","id":"MAL-2026-14272","summary":"Malicious code in price-scripping-js (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (52b5a1792ab4822af305a8d853e858a8063d9e82e5d91d3dbd3a748300aaf7f9)\nprice-scripping-js@1.1.2 runs `node dist/postinstall.js` as its npm postinstall script. That entry point resolves the installing project's root via `process.env.INIT_CWD?? process.cwd()`, reads the project's `.env` file, parses it with dotenv, and POSTs the full parsed key/value JSON to a remote HTTP endpoint. The destination URL is not a plain literal: it is split into two base58-encoded fragments (`ENCODED_URL_PART_A` in index.js, `ENCODED_URL_PART_B` in cli.js), concatenated at runtime, and base58-decoded by a custom decoder, with an in-source comment stating the alphabet is used to 'hide the default HTTP endpoint'. Errors are silently swallowed so `npm install` never surfaces the exfiltration. The package advertises itself in package.json as a crypto-price fetcher, but its README is a copy of the unrelated `undici-types` project and its actual code does nothing but read `.env` and upload it. `.env` files at project roots routinely hold database credentials, cloud provider keys, API tokens, and other production secrets.\n","affected":[{"package":{"ecosystem":"npm","name":"price-scripping-js"},"versions":["1.1.2"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"dist/index.js","sha256":"b8ab49918d9b5cc2f48e1e4f56a9323b34a69d8354e279863f61ea303d2b3bb3","tlsh":"4d9184162df3a7230a9367989317801a6fbc97173504e888b55ed3947f8901ca5a7bb4"},{"path":"README.md","sha256":"8a2f4c245c8a186e213727012de1985c7eb88ff1aa83ec236924a7c266b38f1a","tlsh":"50f055b356c183641a5e09f7c0c79309db2b90ce2fb55c92fc74013f93565aa832a1bc"}],"package_integrity":[{"filename":"price-scripping-js-1.1.2.tgz","hashes":{"sha1":"68c0323543783a8c489ab320412adf08ca0e259d","sha512_sri":"sha512-9IBpPf1R/gwFLnlrL8DHcmx1fieUMIQX5zjhyuzN5J0wdCMWlL8wjnY0tMhADD9elI5K0UN/N9ADYqpNYz9Vyg=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/price-scripping-js/v/1.1.2"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-018386","import_time":"2026-08-19T07:21:21.601327627Z","modified_time":"2026-08-19T06:58:53Z","sha256":"52b5a1792ab4822af305a8d853e858a8063d9e82e5d91d3dbd3a748300aaf7f9","source":"amazon-inspector","versions":["1.1.2"]}]}}