@medisend/shared

{"modified":"2026-08-24T16:47:15Z","published":"2026-08-24T16:47:15Z","schema_version":"1.7.4","id":"MAL-2026-14423","summary":"Malicious code in @medisend/shared (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (cb5857b17f9935d83581e1a24e6d990211fe86631143c7025c3123d1274e7d28)\npackage.json declares a postinstall lifecycle script that runs curl at install time and transmits the installer's hostname (via $(hostname)) as a query parameter to a webhook.site collector. The receiver ID in the URL is left as a `<your-id>` placeholder, so the beacon URL is not fully configured, but the postinstall hook still fires on `npm install` and issues an outbound request carrying host identification to a third-party collector. The package version tag also self-labels as `security-research`, but the shipped behavior — an automatic install-time beacon of host identity to an external collector — matches dependency-confusion / reconnaissance beacon shape rather than a benign library.\n","affected":[{"package":{"ecosystem":"npm","name":"@medisend/shared"},"versions":["0.0.1-security-research"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"package.json","sha256":"eaca57228249dbb468636a5f42fe18a05ae8743c7075df0864317b0542585466","tlsh":"c6e07db17418153705e506ba0830e11dbe25cb0a610a1f1bc6d743a8660d7f5a717a9d"}],"package_integrity":[{"filename":"shared-0.0.1-security-research.tgz","hashes":{"sha1":"467a02d787307955df4bd2478dbfbbb72e73c7a9","sha512_sri":"sha512-nfnkOCon2NZWA18xxrZPNHH5myH3Pwa99+gm6JuxfuXmt+TR25RB/Nn2yc/nUfKIwIiNlpAP93wMb86ca6zy8w=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@medisend/shared/v/0.0.1-security-research"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-018658","import_time":"2026-08-24T16:49:15.531264752Z","modified_time":"2026-08-24T16:47:15Z","sha256":"cb5857b17f9935d83581e1a24e6d990211fe86631143c7025c3123d1274e7d28","source":"amazon-inspector","versions":["0.0.1-security-research"]}]}}