catplatebarcodeparser

{"modified":"2026-09-23T01:40:51Z","published":"2026-09-23T01:40:51Z","schema_version":"1.7.4","id":"MAL-2026-16434","summary":"Malicious code in catplatebarcodeparser (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (189a06b0d55d6dab795bcb9ba3a97aa855b2556a54e85e15adc9f5bf20399976)\ncatplatebarcodeparser@99.2.1 declares preinstall and postinstall lifecycle scripts that execute scripts/run.js on `npm install`. That script reads os.userInfo().username and os.hostname() and POSTs them to a hardcoded out-of-band collector at https://webhook.site/40e9b065-efd7-43a5-916f-3d52281f42b6, and additionally issues a DNS lookup against 40e9b065-efd7-43a5-916f-3d52281f42b6.dnshook.site as a canary. The version number (99.2.1) and package name pattern are consistent with a dependency-confusion lure intended to win resolution against an internal package of the same name; installing the lure automatically leaks installer identity to an author-controlled endpoint.\n","affected":[{"package":{"ecosystem":"npm","name":"catplatebarcodeparser"},"versions":["99.2.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"scripts/run.js","sha256":"167124ed0e79a45403d7f00a8ee93bd8e584333988f2afdd20b7b8cae13e96a7","tlsh":"db2111fa89f981181ef341c0a34fdc5aa123e60a7442eaa0769d03721f899ed45338f8"}],"package_integrity":[{"filename":"catplatebarcodeparser-99.2.1.tgz","hashes":{"sha1":"af1d793c8987c66ad4cb785d1f9d51caf9f90cb9","sha512_sri":"sha512-rTnGT8hj2KZmi0qlShANa0Ffr5+IxhwBswPbxeIyFCsxcKvBRi599SSk3umh34DqD+k+o8Kcr8C1SlACc1UZMQ=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/catplatebarcodeparser/v/99.2.1"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-020327","import_time":"2026-09-23T01:50:19.199329521Z","modified_time":"2026-09-23T01:40:51Z","sha256":"189a06b0d55d6dab795bcb9ba3a97aa855b2556a54e85e15adc9f5bf20399976","source":"amazon-inspector","versions":["99.2.1"]}]}}