test1sdsd2

{"modified":"2026-09-21T03:24:04Z","published":"2026-09-21T03:24:04Z","schema_version":"1.7.4","id":"MAL-2026-16316","summary":"Malicious code in test1sdsd2 (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (3c7bd7c5932337e17adaf4900cb7e29766fe6b5307bd170b38660dd05497ebdc)\nPackage test1sdsd2@99.99.99 declares preinstall and postinstall hooks in package.json that execute index.js on `npm install`. index.js performs an HTTP GET to the hardcoded bare IP http://128.199.122.145/?test1sdsd2, embedding the package name in the query string, which confirms code execution on the installer's machine and leaks install-signal (package name, implicit source IP, timing) to an attacker-controlled endpoint. The version number 99.99.99 combined with the beacon shape is the canonical dependency-confusion probe pattern used to detect resolution of an internal package name against a public registry. The package ships no legitimate library functionality.\n","affected":[{"package":{"ecosystem":"npm","name":"test1sdsd2"},"versions":["99.99.99"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"fdf90f1e8adb776891666c8b2c43cf8af9a59bedbf98949c9d0f2e58318a5703","tlsh":"e0c08cc25382f3848af108c2a929165a230df070b9fd15b6e34c23ad889396d21a3ac1"},{"path":"package.json","sha256":"07c8bdc3460ed80ca5cf91ba8a4df44bf00a0c98654c4900e2fb8c491d544c01","tlsh":"eae09261cc509b7314f812e5687a1b07b1626f2f82686c0b34f3b08da6a2126449ef29"}],"package_integrity":[{"filename":"test1sdsd2-99.99.99.tgz","hashes":{"sha1":"c1e19121376243b21dd603915b08fd20ba4f50e1","sha512_sri":"sha512-a8a8BP+MAiNaXutK/R/rdeg5G/MKROm9kX9S8cwSb9Ye5cR948l12ze1oulclkmXvq9GfosWWCgp4su8jS6P9Q=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/test1sdsd2/v/99.99.99"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-020214","import_time":"2026-09-21T03:24:22.184240379Z","modified_time":"2026-09-21T03:24:04Z","sha256":"3c7bd7c5932337e17adaf4900cb7e29766fe6b5307bd170b38660dd05497ebdc","source":"amazon-inspector","versions":["99.99.99"]}]}}