shoplist-app

{"modified":"2026-09-25T14:22:35Z","published":"2026-09-25T14:14:09Z","schema_version":"1.7.4","id":"MAL-2026-17185","summary":"Malicious code in shoplist-app (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (fdceadb01f08162934382b121e813236b86adc0d4d74b7b2f062c78e529c34f6)\nshoplist-app@99.99.99 is a dependency-confusion / typosquat beacon. preinstall.js is wired into every lifecycle hook (preinstall, install, postinstall, prepare, prepublish) and issues an HTTPS GET to the hardcoded endpoint https://eo8f3m3ho26a0nm.m.pipedream.net/, transmitting the installer's machine hostname via os.hostname() (smuggled into a `host` HTTP header) together with package identity in the query string. index.js — the package `main` — independently fires a second HTTPS GET to the same Pipedream collector at require/import time, carrying os.platform() and a `trigger=runtime` marker. The package ships no functional code beyond these beacons; its version (99.99.99) and description (\"test\") are consistent with a name-squat probe designed to identify which internal build hosts resolve the name shoplist-app. The exfiltrated data (hostname, OS platform, package-name confirmation) gives the operator of the Pipedream endpoint a map of environments where a shoplist-app dependency reference successfully resolves to this public package — the standard reconnaissance stage of a dependency-confusion attack.\n","affected":[{"package":{"ecosystem":"npm","name":"shoplist-app"},"versions":["993.99.99","99.99.99"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"preinstall.js","sha256":"9ef16bffed95a49676ec4c882388450a002d8e56ae8ac6a794ff07cb1ae56042","tlsh":"a421ed6f29f5013136d7a9ee150b4d45b393c253535aced4fa8e03600f4687846f32e1"},{"path":"index.js","sha256":"fbdf52c9f9585e0aaa1477fbbd2f0e3e9aa99064935f50f72b570e5a62262075","tlsh":"a401f1f706f4623012d489d5f4139786b097d213c34686e0e2de13e01f02ca552b35f0"}],"package_integrity":[{"filename":"shoplist-app-993.99.99.tgz","hashes":{"sha1":"3d841cdd7e119df37b6c79c5d9b5b91f1c8e7bde","sha512_sri":"sha512-JVNJO55dfEY+Oh1Bp7aKv0bhAUkvwf+WY26ODs4HcRBwgdnzMyzQSyEmvtYPX23S1jE1FeX6VJdtnR5tDNLCMA=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/shoplist-app/v/993.99.99"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/shoplist-app/v/99.99.99"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-020560","import_time":"2026-09-25T14:20:34.902542226Z","modified_time":"2026-09-25T14:14:22Z","sha256":"e93e834e421a980fa8418d93ad972f9f1c2ca56cbc7662b84e0627c19a8be248","source":"amazon-inspector","versions":["993.99.99"]},{"id":"IN-MAL-2026-020559","import_time":"2026-09-25T14:20:34.878257986Z","modified_time":"2026-09-25T14:14:09Z","sha256":"fdceadb01f08162934382b121e813236b86adc0d4d74b7b2f062c78e529c34f6","source":"amazon-inspector","versions":["99.99.99"]}]}}