tetomood

{"modified":"2026-09-16T06:35:38Z","published":"2026-09-16T06:35:38Z","schema_version":"1.7.4","id":"MAL-2026-16216","summary":"Malicious code in tetomood (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (6c09686feb7c38e815ef9a615a6ceba2444029a34ea9d6bee8598a76bc8e8f92)\npackage.json declares both preinstall and postinstall scripts that invoke wget to POST the installer's current working directory ($(pwd)) and machine hostname ($(hostname)) to a hardcoded Discord webhook endpoint on discord.com at install time. The tarball ships only package.json (611 bytes); the declared main entry index.js is absent, so the package has no legitimate functionality — the lifecycle beacons are its sole purpose. Installing the package causes automatic host reconnaissance data to be sent to an author-controlled remote endpoint without consent.\n","affected":[{"package":{"ecosystem":"npm","name":"tetomood"},"versions":["12.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"package.json","sha256":"6dd2fe7c4dc3b92baca6b52f1cf89fff5b3211862346a9c12ff668cb504595dd","tlsh":"1cf0acf25d10e572bbcb0ea63ad29a4a7aa39d4f1881163cd1034b0c03ce36f10b1a46"}],"package_integrity":[{"filename":"tetomood-12.0.0.tgz","hashes":{"sha1":"5cd6977336999b4253f6f41b7acf3a7219d3f70a","sha512_sri":"sha512-Xj2Hkfw/BbWGGloD+hhQF25xzK2lK/a+BFzrV6+Fd3RnIkng927oY5dyV2y3jUJjkEYnNmF5Y3yi/MofMSGIcg=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/tetomood/v/12.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-020086","import_time":"2026-09-16T06:56:08.843090937Z","modified_time":"2026-09-16T06:35:38Z","sha256":"6c09686feb7c38e815ef9a615a6ceba2444029a34ea9d6bee8598a76bc8e8f92","source":"amazon-inspector","versions":["12.0.0"]}]}}