@pelmnaads/naads-common-logger

{"modified":"2026-05-15T07:39:04Z","published":"2026-05-14T19:25:51Z","schema_version":"1.7.4","id":"MAL-2026-3748","summary":"Malicious code in @pelmnaads/naads-common-logger (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (68990dfacdc750bf464d646aca4855c2dd23bbefcadef1d9638e2d663a23fc57)\nThe package is published to the public npm registry under `@pelmnaads/naads-common-logger` with version `19999.0.1` — the canonical dependency-confusion pattern, where an abnormally high version is used to make npm's resolver prefer this public package over a private internal package of the same name. On `npm install`, a `preinstall` lifecycle script (preinstall.js:5-9) makes an HTTPS GET to `h5nvwrz2815ubw84cpkwhezm5db9z1nq.b.mburpcollab.com` with query parameters `package=<npm_package_name>&hostname=<os.hostname()>`, transmitting the installer's hostname off-host to a Burp Collaborator out-of-band interaction endpoint. The README states this is an authorized security test, but the code path and effect on an unsuspecting installer are identical to a hostile dependency-confusion attack: build hosts silently disclose their identity to a third-party domain during `npm install`, with no opt-in. Any build system that resolves this package (e.g., an internal Pelmorex pipeline expecting the private `@pelmnaads/naads-common-logger`) would leak hostname data.\n","affected":[{"package":{"ecosystem":"npm","name":"@pelmnaads/naads-common-logger"},"versions":["19999.0.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"domains":["h5nvwrz2815ubw84cpkwhezm5db9z1nq.b.mburpcollab.com"],"evidence_files":[{"path":"preinstall.js","sha256":"f953effaba2900cece999a0e4f06d5eb4ac614e490856715c678213d2cec8a6b","tlsh":"13e0f1f50171d72057f023c4e08ca50a1423d213748e59b0bacd13e29f854b86a96cf0"},{"path":"package.json","sha256":"11f68af131ee9e697e4a07518447cc623810a3c8e314473f24a87745df66b91d","tlsh":"80d022754c45da322ac803c2243f720921a9cbaa6000092c9adb700be381263082b148"}],"package_integrity":[{"filename":"naads-common-logger-19999.0.1.tgz","hashes":{"sha1":"beaf5d70084a3c99d3c125103ce3d27e9e553486","sha512_sri":"sha512-FzJ2y8GAG3og3Mggld5FreQatbt2KLubLqlCuQ68lKnbAIqo4lMr5kug5uHwNiAL/aN3nbAtPQihpl8z0EmR+g=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@pelmnaads/naads-common-logger/v/19999.0.1"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["actran@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-002766","import_time":"2026-05-15T07:37:19.454275828Z","modified_time":"2026-05-14T19:25:53Z","sha256":"2f25d490deb5c32e9675f7941c54e8e9c9c1c180adaf00de19e4bb2a10325c47","source":"amazon-inspector","versions":["19999.0.1"]},{"id":"IN-MAL-2026-002763","import_time":"2026-05-15T07:37:19.409978984Z","modified_time":"2026-05-14T19:25:51Z","sha256":"68990dfacdc750bf464d646aca4855c2dd23bbefcadef1d9638e2d663a23fc57","source":"amazon-inspector","versions":["19999.0.1"]},{"id":"IN-MAL-2026-002786","import_time":"2026-05-15T07:37:19.946869887Z","modified_time":"2026-05-15T00:04:56Z","sha256":"8e4fd2828e3ff35aa485baef1b289b8faa19386e1c5199cbddb213b844a57733","source":"amazon-inspector","versions":["19999.0.1"]}]}}