test1ro

{"modified":"2026-09-21T03:25:47Z","published":"2026-09-21T03:23:24Z","schema_version":"1.7.4","id":"MAL-2026-16315","summary":"Malicious code in test1ro (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (8166d7eaf8dab64a6c21d0e0a871c64e213147082a414b93816fb080c8044b1e)\npackage.json declares preinstall and postinstall hooks that run `node index.js`, which reads `os.hostname()` and issues an HTTP GET to the hardcoded third-party collector `http://eo8f3m3ho26a0nm.m.pipedream.net/<package>?h=<hostname>`. The behavior fires automatically during `npm install` without any user action, transmitting the installer's host identifier and the resolved package name to an external Pipedream request-bin. The manifest also declares `test1ro: ^999.99.99` as its own dependency at an implausibly high version, characteristic of a dependency-confusion artifact designed to be resolved from public npm ahead of an internal package of the same name. The generic name, self-referential high-version pin, and install-time beacon to an attacker-controlled collector match the standard dependency-confusion probe shape.\n","affected":[{"package":{"ecosystem":"npm","name":"test1ro"},"versions":["999.99.99","99.99.99"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"85d31266e09f74f188b3569976632d1aef8cab83e7d328572d413c057661d89f","tlsh":"80e02bc707d9b37079e18ec0e03709077386e13635b8c2b4a14d87e95dd2ca509b36e0"},{"path":"package.json","sha256":"945bd51f89f48bbff4c92d6c82d5a743b0eaf25ff99033f4a461abd2a1217d4b","tlsh":"52e06551dc509b7314f816d868792b07b1515f2f97685c4b34f3b08da6a222740deb29"}],"package_integrity":[{"filename":"test1ro-999.99.99.tgz","hashes":{"sha1":"3c02cbcbf4cdbf6a8becead818c0528b21371f83","sha512_sri":"sha512-+n1Hh+06rQpOkt7eeiIzgBlnZ589WQcvugB2ucJFlzcKKNfbOQEEEP7IB/5+xAcUKiZ0zQ785dx0ObdrUqCb3g=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/test1ro/v/999.99.99"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/test1ro/v/99.99.99"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-020212","import_time":"2026-09-21T03:24:22.034134991Z","modified_time":"2026-09-21T03:23:46Z","sha256":"8166d7eaf8dab64a6c21d0e0a871c64e213147082a414b93816fb080c8044b1e","source":"amazon-inspector","versions":["999.99.99"]},{"id":"IN-MAL-2026-020210","import_time":"2026-09-21T03:24:21.78694115Z","modified_time":"2026-09-21T03:23:24Z","sha256":"9b4c1e61651ca7fc4d5b2dc93bc240ffd6339dfe0fde02e66740517cc9c957bf","source":"amazon-inspector","versions":["99.99.99"]}]}}