test12vv36

{"modified":"2026-09-21T03:23:35Z","published":"2026-09-21T03:23:35Z","schema_version":"1.7.4","id":"MAL-2026-16311","summary":"Malicious code in test12vv36 (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (9292921d0fe368160694717f99eca753070a4249696c72b2f1bff9594cab40be)\ntest12vv36@99.99.99 declares both preinstall and postinstall lifecycle hooks that execute index.js on npm install. index.js issues an HTTP GET to a hardcoded bare-IP endpoint at http://128.199.122.145/?test12vv36, sending the package name in the query string and disclosing the installer's source IP to the operator of that host. The version number (99.99.99) and package.json shape (dependency on a typosquat name 'requests@^0.3.0' plus a duplicate misspelled 'Dependencies' key) are consistent with a dependency-confusion or proof-of-concept publish rather than a functional library. Installing the package causes unauthenticated, unencrypted outbound network activity to attacker-controlled infrastructure at install time, confirming successful installation on the host.\n","affected":[{"package":{"ecosystem":"npm","name":"test12vv36"},"versions":["99.99.99"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"bc8d807a41cca39765c8272af40c02735cfd226420e8c8ab16da5227d41fbcf9","tlsh":"57c08cc25382f3848bf1088269292616230df170b9fc04b6e34c23ad488397d25a3ac1"},{"path":"package.json","sha256":"052723013adc7fb5de8366d0af1c6b432299b1d63896675a6112f8e06aaf9aaf","tlsh":"fbe09261cc609a7314fc12e568791b07b1625f2b42685c0b34f3b48d66a2126449ef29"}],"package_integrity":[{"filename":"test12vv36-99.99.99.tgz","hashes":{"sha1":"89863594917a314d392f5458c2423134d0638349","sha512_sri":"sha512-ttBwu8SPnBNfLLTH96s2SL14wm1Sn4j2IYRzUr6gtpydWnxag5Ymwp6x3l5Lix/g93hmQao6CAyszfPla2aijA=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/test12vv36/v/99.99.99"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-020211","import_time":"2026-09-21T03:24:21.934740204Z","modified_time":"2026-09-21T03:23:35Z","sha256":"9292921d0fe368160694717f99eca753070a4249696c72b2f1bff9594cab40be","source":"amazon-inspector","versions":["99.99.99"]}]}}