@medisend/auth

{"modified":"2026-08-24T16:46:29Z","published":"2026-08-24T16:46:29Z","schema_version":"1.7.4","id":"MAL-2026-14421","summary":"Malicious code in @medisend/auth (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (8363fc41a00733469f69df79f45ecebd190ac85d16d8cbdd48a61fe5bfb67003)\npackage.json declares a postinstall lifecycle script that runs `curl` against https://webhook.site/74ed1be3-96d6-48c3-932b-6b1dbabaff97 with the installer's hostname appended as a query parameter (`?pkg=medisend-auth-$(hostname)`). On `npm install`, this fires automatically and transmits an installer-identifying host indicator to a third-party anonymous collector endpoint controlled by whoever holds the webhook.site token. The @medisend/* scope and the package name pattern are consistent with dependency-confusion beaconing against an internal namespace.\n","affected":[{"package":{"ecosystem":"npm","name":"@medisend/auth"},"versions":["0.0.1-security-research"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"package.json","sha256":"00f6085f70cef192e1439a4753477665f4e15f1de0027e81da888251c6546180","tlsh":"03e07db1249421360ed843e70930900d7975c90d200b6f1fc69b06f8a54cbf91b12acd"}],"package_integrity":[{"filename":"auth-0.0.1-security-research.tgz","hashes":{"sha1":"229030c1b5cc5a497fa760febb59b4002df9efeb","sha512_sri":"sha512-gB21LLezdmF9nryoRDeOyW+vIgkmgLEYIlXDzk/zycipoIfMHl+zAyIDwIgqyH1r4McevgMe8gSzycmyZtmOrw=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@medisend/auth/v/0.0.1-security-research"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-018653","import_time":"2026-08-24T16:49:15.159439067Z","modified_time":"2026-08-24T16:46:29Z","sha256":"8363fc41a00733469f69df79f45ecebd190ac85d16d8cbdd48a61fe5bfb67003","source":"amazon-inspector","versions":["0.0.1-security-research"]}]}}