commerce-materials

{"modified":"2026-09-21T03:28:22Z","published":"2026-09-21T03:28:22Z","schema_version":"1.7.4","id":"MAL-2026-16330","summary":"Malicious code in commerce-materials (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (bdfff371a76fd4cef2247de8c595a3981d58353391141b58a8ce31e03ec9da6d)\ncommerce-materials@1.0.0 declares preinstall and postinstall lifecycle scripts that run callback.js on every npm install. callback.js collects hostname, username, platform, cwd, home directory, CI/cloud provider fingerprints, network interface addresses, and a filtered list of process.env variable names matching credential-shaped patterns (token, secret, key, password, aws, azure, gcp, npm, ssh, jwt). It also probes the current working directory for the presence of.env,.env.local,.env.production,.npmrc,.yarnrc, package-lock.json, yarn.lock,.git/config,.docker/config.json, credentials, and secrets.json. The assembled report is POSTed to api.telegram.org using a hardcoded bot token (8636277735) and chat_id (1064260758). A secondary DNS-based exfiltration channel base64-encodes host, user, and CI fields into a subdomain of dc-callback.example.com and issues dns.resolve queries, providing a fallback when HTTPS egress is filtered. The behavior fires automatically on npm install with no user interaction and no documented opt-in.\n","affected":[{"package":{"ecosystem":"npm","name":"commerce-materials"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"callback.js","sha256":"ae39c187820502961774874f3376f91f238a1d8027c6a1ca7b1fb9b641f7a683","tlsh":"90d1d6da21ab991115e162d6590e6c036849e0073f0db5e93e2c93a19fc9d3c93b37fb"}],"package_integrity":[{"filename":"commerce-materials-1.0.0.tgz","hashes":{"sha1":"36539c800ebe930a088c0b4950ab220ebac5115d","sha512_sri":"sha512-zzQZezkIijuf7kA0fHswfi9poV1UNRXMlOe/NAA4SN0IMa2wT1T2MnUq2RM7iMeTt7dUytI5Xfv6mH/Gjkr0yA=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/commerce-materials/v/1.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-020215","import_time":"2026-09-21T03:46:36.619905871Z","modified_time":"2026-09-21T03:28:22Z","sha256":"bdfff371a76fd4cef2247de8c595a3981d58353391141b58a8ce31e03ec9da6d","source":"amazon-inspector","versions":["1.0.0"]}]}}