cacao1

{"schema_version":"1.7.4","id":"MAL-2026-14591","published":"2026-08-28T12:25:44Z","modified":"2026-08-28T19:35:51.464956928Z","summary":"Malicious code in cacao1 (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (403a43aab3b982d17c5c01d7df45149d796e7185f4137bf4a92675351a1b50e8)\nThe package has no advertised functionality (empty description, self-referential dependency on its own name at ^9.9.9). Its package.json declares both preinstall and postinstall lifecycle scripts that execute index.js, which reads os.hostname() and issues an HTTP GET to https://eo8f3m3ho26a0nm.m.pipedream.net/cacao1 with the hostname included as a query parameter. Installing the package therefore causes the installer's hostname to be transmitted to a hardcoded third-party collector controlled by the package author. The structure (empty description, self-dependency, lifecycle-triggered beacon to a pipedream.net collector, unusual 9.9.9 version) matches a dependency-confusion beacon rather than a functional library.\n\n## Source: ossf-package-analysis (7e80e85bc2ce7bba9bc4f288f4757cb9921d0fc4d7635c0a07ba35d19382df79)\nThe OpenSSF Package Analysis project identified 'cacao1' @ 9.9.9 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package communicates with a domain associated with malicious activity.\n","affected":[{"package":{"name":"cacao1","ecosystem":"npm"},"versions":["9.9.9"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"95beb1ce62037661b6c609349821059cafe717dc0e67428c03fce95c6531f1e6","tlsh":"3dd012d30be9b264b6808d8194625b0b775be10732b8c5b4d04e87daddd29e10933ce0"},{"path":"package.json","sha256":"3472fbebfba6145c8c850501ce6a2d97eed81267af83dc2b07203c5226b43c68","tlsh":"cce0eda2cc509b6310fc16e868791b07f1621f2f126c4c4f34f3b08caaa2133009eb2a"}],"package_integrity":[{"filename":"cacao1-9.9.9.tgz","hashes":{"sha1":"35a0eb3acb366f58dd36e81d8c911f41ec37bdd6","sha512_sri":"sha512-eUR4PfTF/1RZXFBakOUWLNe0OYcFAoOJ9ZGajiIQqXGTb/rFZZtRM+myxxmusbkI2hzswmEOg6BFsm8ohBho1Q=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/cacao1/v/9.9.9"}],"database_specific":{"malicious-packages-origins":[{"import_time":"2026-08-28T15:05:27.151059052Z","modified_time":"2026-08-28T12:25:44Z","sha256":"7e80e85bc2ce7bba9bc4f288f4757cb9921d0fc4d7635c0a07ba35d19382df79","source":"ossf-package-analysis","versions":["9.9.9"]},{"id":"IN-MAL-2026-018817","import_time":"2026-08-28T19:33:50.794736103Z","modified_time":"2026-08-28T17:06:10Z","sha256":"403a43aab3b982d17c5c01d7df45149d796e7185f4137bf4a92675351a1b50e8","source":"amazon-inspector","versions":["9.9.9"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"OpenSSF: Package Analysis","contact":["https://github.com/ossf/package-analysis","https://openssf.slack.com/channels/package_analysis"],"type":"FINDER"}]}