web-main

{"modified":"2026-09-14T16:42:39Z","published":"2026-09-14T16:42:39Z","schema_version":"1.7.4","id":"MAL-2026-16153","summary":"Malicious code in web-main (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (61680a5d53758bc9eb99b1cd2566e6e19139d09fee10a0096a5e72bb0953a5b2)\npackage.json declares `preinstall: node index.js`, causing index.js to execute automatically on `npm install`. The script collects os.hostname(), os.userInfo() (username/uid/gid/shell), platform, arch, homedir, and the stdout of `whoami`, `id`, and `pwd` via child_process.exec, then POSTs the aggregated JSON to a hardcoded endpoint at https://smi54v4uvb9q7ve5t6fnyro16scj0co1.oastify.com/system-info (a Burp Collaborator out-of-band host). No legitimate functionality is present; the package's sole effect on install is host reconnaissance and exfiltration to an attacker-controlled OOB collector.\n","affected":[{"package":{"ecosystem":"npm","name":"web-main"},"versions":["22.1.2"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"d35df18d79caf14c25e114745aa01e21569ca00c80cb42f008f41613ba2c40f7","tlsh":"465130c515f659251ba7a8494a0f9402a327e0033509ee55bfcc8740af9937c97f0af6"},{"path":"package.json","sha256":"80cd4d0d2a3ea294a07d692ed116b1e05f55272fddf07ca3004dc0fa663ffb23","tlsh":"69d05e345e216a2329c506d6086ea44662a18f2f4904780997cb183c95de67398ff30d"}],"package_integrity":[{"filename":"web-main-22.1.2.tgz","hashes":{"sha1":"f22e35d441c60acc213e1b251420ac150309d714","sha512_sri":"sha512-lebglOYs2XS9DoLLgGZG7z0SElaox3Pyst5TBxZg2ntvwZSzRivCp717qy59Zz52a+n2/bb0zhSdZ9/bFWnFoQ=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/web-main/v/22.1.2"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-020023","import_time":"2026-09-14T17:15:20.390495237Z","modified_time":"2026-09-14T16:42:39Z","sha256":"61680a5d53758bc9eb99b1cd2566e6e19139d09fee10a0096a5e72bb0953a5b2","source":"amazon-inspector","versions":["22.1.2"]}]}}