zeal-util-hooks

{"schema_version":"1.7.4","id":"MAL-2026-16541","published":"2026-09-22T17:46:48Z","modified":"2026-09-30T00:54:52.588398431Z","summary":"Malicious code in zeal-util-hooks (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (2c9ed95500d2f1c637bcf47151a9220c0a81ee6cbd7a7aa4a8f66c74fed6e341)\npostinstall.js and index.js load canary.js, which POSTs a JSON payload to https://npm-canary.aveliscare.com/beacon at install time and on require. The payload contains os.hostname(), os.userInfo() username, cwd, process.platform, node version, npm user agent, parent package name/version, and a fixed allowlist of CI-identifier env vars (GITHUB_REPOSITORY, GITHUB_ACTOR, GITHUB_REF, GITHUB_RUN_ID, EAS/VERCEL/BUILDKITE identifiers). The endpoint is overridable via ZEAL_CANARY_URL but defaults to the hardcoded aveliscare.com host. The package advertises publisher Zeal (getzeal.io, github.com/zeal-io); the beacon destination aveliscare.com does not match that publisher. The collected fields are host/CI identifiers rather than credentials or filesystem contents, and no code execution, credential read, or persistent artifact is present. The install-time/require-time outbound network without opt-out breaks air-gapped installs, and the publisher/destination-domain mismatch is the shape typical of a dependency-confusion canary used to log where a placeholder name resolves.\n","affected":[{"package":{"name":"zeal-util-hooks","ecosystem":"npm","purl":"pkg:npm/zeal-util-hooks"},"versions":["0.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"canary.js","sha256":"313f6afebeb44640d7df7a1995d0958bed918ecf2be8f171d4fbfe8dcab91f1d","tlsh":"acd1d86613f052762b8206b4591f00979736e027722aa170f5af92143f4a6bc87f3deb"}],"package_integrity":[{"filename":"zeal-util-hooks-0.0.0.tgz","hashes":{"sha1":"80cf18c7b742245379c6d2bf645fb9cc8ed80758","sha512_sri":"sha512-7eDJoy6Q/vblvlqgsv2+tECIgmge0lB0iSQyXRxim8s80e/NIxRCY+TEmDTHb+3gxQNosTu4Rk37lwD2cJHaxw=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/zeal-util-hooks/v/0.0.0"}],"database_specific":{"malicious-packages-origins":[{"id":"RLMA-2026-10815","import_time":"2026-09-24T09:21:36.731977575Z","modified_time":"2026-09-22T17:46:48Z","sha256":"aadbcafaeb12ab9324d6bffe1b9c7bbe510663d033aaf4ff9b5ad5fee94156f9","source":"reversing-labs","versions":["0.0.0"]},{"id":"IN-MAL-2026-020747","import_time":"2026-09-30T00:52:54.321628003Z","modified_time":"2026-09-30T00:31:32Z","sha256":"2c9ed95500d2f1c637bcf47151a9220c0a81ee6cbd7a7aa4a8f66c74fed6e341","source":"amazon-inspector","versions":["0.0.0"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"ReversingLabs","contact":["https://www.reversinglabs.com"],"type":"FINDER"}]}