live-detection-dashboard

{"schema_version":"1.7.4","id":"MAL-2026-17434","published":"2026-09-30T07:11:22Z","modified":"2026-10-04T23:42:37.936785066Z","summary":"Malicious code in live-detection-dashboard (npm)","details":"live-detection-dashboard is a dependency-confusion package: it takes a name that looks like an internal project, uses an inflated version (100.0.0) so it outranks private-registry versions, and runs `node setup.js || true` as a preinstall script on npm install. setup.js sends the hostname, username, working directory, OS, architecture, Node.js version and configured npm registry, with a per-package tracking token, in an HTTPS POST to `https://s85r5k14qk.execute-api.us-east-1.amazonaws.com/prod/hook`. The npm account amel10 published live-detection-dashboard and 9 similar packages within two minutes on 2026-09-30, all with the same setup.js.\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (5d6433d908aabd1002455fbed5a7afdf730c557f6c072fed817d76cad31a5ccb)\nThe package's `preinstall` lifecycle script fires automatically on `npm install` and issues an HTTPS POST to the hardcoded endpoint https://s85r5k14qk.execute-api.us-east-1.amazonaws.com/prod/hook, carrying a JSON body composed of installer-side identifiers: os.hostname(), os.userInfo().username, process.cwd(), process.platform, process.arch, the Node.js version, and the configured npm registry, along with a static token. The advertised functionality of the package is a trivial random-hex helper, which does not require network activity or host/user identifiers, and the data flow is neither documented nor caller-configurable. The destination is an author-controlled AWS API Gateway. Package version 100.0.0 combined with a minimal declared purpose and an install-time beacon is consistent with a dependency-confusion / reconnaissance payload targeting internal build environments.\n","affected":[{"package":{"name":"live-detection-dashboard","ecosystem":"npm"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"versions":["100.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"setup.js","sha256":"9dc27728f7859df11c7b12fcde415bd398303a987166f16eed7f117c8cf33a30","tlsh":"e801f4f495f0d5b93afc51c4f250b94793b7d124314769d0c8e881557f89af809328f2"}],"package_integrity":[{"filename":"live-detection-dashboard-100.0.0.tgz","hashes":{"sha1":"a798d4e694bfe65dfe740347974a231d66202206","sha512_sri":"sha512-KU7r2XNWl6ChTI8tNWRoq3/Pm2/Pe/mkQAyAPMFwaRnqWSTwFHYESwur88lEq2VK62nWWDzx343KjHSfr72Aog=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/live-detection-dashboard"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/live-detection-dashboard/v/100.0.0"}],"database_specific":{"iocs":{"domains":["s85r5k14qk.execute-api.us-east-1.amazonaws.com"],"files":[{"digests":{"sha256":"422b33870d5a8c7e434c7fd62f24d70d88d5cb05df1d45c691c242d6294c2d16"},"note":"preinstall: node setup.js || true","paths":["package.json"],"source":"PACKAGE_ARCHIVE"},{"digests":{"sha256":"9dc27728f7859df11c7b12fcde415bd398303a987166f16eed7f117c8cf33a30"},"note":"Executed by the preinstall script.","paths":["setup.js"],"source":"PACKAGE_ARCHIVE"}],"urls":["https://s85r5k14qk.execute-api.us-east-1.amazonaws.com/prod/hook"]},"malicious-packages-origins":[{"id":"IN-MAL-2026-020937","import_time":"2026-10-04T23:40:43.854514987Z","modified_time":"2026-10-04T23:22:44Z","sha256":"5d6433d908aabd1002455fbed5a7afdf730c557f6c072fed817d76cad31a5ccb","source":"amazon-inspector","versions":["100.0.0"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"InvisiRisk, Inc.","contact":["https://www.invisirisk.com","mailto:research@invisirisk.com"],"type":"FINDER"}]}