lumen-pages-community

{"modified":"2026-08-21T22:11:02Z","published":"2026-08-21T22:11:02Z","schema_version":"1.7.4","id":"MAL-2026-14356","summary":"Malicious code in lumen-pages-community (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (b7c1d6b7b99791f7bbd5999021f109bef569a6c681eda0bb6196b459b12a3808)\nlumen-pages-community@9.9.9 declares a postinstall hook (`node dc.js`) that runs automatically on `npm install`. dc.js collects the installer's hostname, username, current working directory, platform, Node version, CI environment variable, and npm user-agent, then issues an HTTPS GET to a hardcoded webhook.site collector URL (https://webhook.site/b00492c6-27ba-4ea0-a9cb-dd50b3770250/dc) with those fields as query parameters. The package name plus a 9.9.9 version and no library functionality matches the dependency-confusion shape: a high-version public namesake that catches internal-name resolution and phones home from any host that resolves it. A self-labeled 'research placeholder' framing in the package description does not change the runtime behavior — installer identifiers leave the host at install time to a third-party collector the installer did not opt into.\n","affected":[{"package":{"ecosystem":"npm","name":"lumen-pages-community"},"versions":["9.9.9"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"dc.js","sha256":"db09ea3714030d84eee4eb3d0f5f9ec1b3fcbcabc952726bac728ef03b5c3dad","tlsh":"1021945b2166f42205b370d0375f220c61fae1228e82ea993428e2d4af346781252cfd"},{"path":"package.json","sha256":"e5bc7e2ed956a118b24c8b6b0917c7dfccca953ea7e58962bd5427fe0b43fcd6","tlsh":"22e07d444920523308d55ee94473514de1b10d5f110da905178351888298ff748b934f"}],"package_integrity":[{"filename":"lumen-pages-community-9.9.9.tgz","hashes":{"sha1":"93abca10f1876e86c6cd933b30f5b8ca9197dc8d","sha512_sri":"sha512-kwA81Fg9Mv16OmkW5UT/TzxIfLzyGP5Er2ekuTkqGqPGqBs6WHaoLRlxrGPHsvTfLOAbdsmFwF2SnGLiKEecIg=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/lumen-pages-community/v/9.9.9"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-018512","import_time":"2026-08-21T22:42:49.933927379Z","modified_time":"2026-08-21T22:11:02Z","sha256":"b7c1d6b7b99791f7bbd5999021f109bef569a6c681eda0bb6196b459b12a3808","source":"amazon-inspector","versions":["9.9.9"]}]}}