finup-mongo-library

{"modified":"2026-06-18T19:21:56Z","published":"2026-05-21T12:28:01Z","schema_version":"1.7.4","id":"MAL-2026-4564","summary":"Malicious code in finup-mongo-library (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (1d9d0b210938322b805e1c8d94db07f45ca029fc4e69fb3a57f424eb885c1a39)\ndist/common/instrument.js calls Sentry.init() at module top level with a hardcoded DSN pointing at the author's Sentry project (o4511257159139328.ingest.us.sentry.io/4511257262161920), with tracesSampleRate and profilesSampleRate both set to 1.0. Because dist/index.js re-exports this module via __exportStar, any consumer that does `require('finup-mongo-library')` (or imports it in a NestJS app, the package's stated purpose) globally configures the Sentry SDK singleton in their Node.js process. From that point onward, all uncaught exceptions, performance traces, and profiles produced by the consumer's application — which routinely include stack frames, source file paths, request URLs, query parameters, and incidental PII captured in error context — are shipped to a Sentry account the author controls, with no caller opt-in and no documented disclosure. This is a silent-relay shape: the destination is hardcoded by the author, the trigger is module import, and the data flowing out is the consumer's application telemetry, not the package's own. A separately-shipped HttpExceptionFilter additionally POSTs request bodies to a Telegram bot URL, but that destination is read from consumer env vars, so it is opt-in and not part of the relay finding.\n","affected":[{"package":{"ecosystem":"npm","name":"finup-mongo-library"},"versions":["4.0.1","3.9.9","4.0.6","4.0.7","4.1.3","4.0.9","4.0.5","4.0.4","4.1.2","4.1.5","4.2.2","4.2.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"dist/common/instrument.js","sha256":"a54e764ec038c972d9bcde6d5eaebbcc0918ca3d00ed2d5877f07d1bbdb7c23e","tlsh":"7231858679f9f95190b224bc6bbf8006fab40533006cf010b76cc7f42f6245562ecd9a"}],"package_integrity":[{"filename":"finup-mongo-library-4.0.1.tgz","hashes":{"sha1":"962d06cc4bfc281d78e3cb554ca7a496dbed469d","sha512_sri":"sha512-C3HOJJaf+idH4zFee2TM0QI1QfFGf7Q1E8VaVd1p+mEzTJZRkfnWG8h8BzvwUT0FknCLmIbhBkIpBppF1r61Zw=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/finup-mongo-library/v/4.0.1"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/finup-mongo-library/v/3.9.9"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/finup-mongo-library/v/4.0.6"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/finup-mongo-library/v/4.0.7"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/finup-mongo-library/v/4.1.3"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/finup-mongo-library/v/4.0.9"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/finup-mongo-library/v/4.0.5"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/finup-mongo-library/v/4.0.4"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/finup-mongo-library/v/4.1.2"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/finup-mongo-library/v/4.1.5"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/finup-mongo-library/v/4.2.2"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/finup-mongo-library/v/4.2.1"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["actran@amazon.com","inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"source":"amazon-inspector","sha256":"0ebcd2feb8924949312b4c4060c51256c9a62edc9793243b8f00f5dbf6bcc747","import_time":"2026-05-26T05:52:05.708260392Z","id":"IN-MAL-2026-004181","modified_time":"2026-05-22T09:55:22Z","versions":["4.0.1"]},{"source":"amazon-inspector","sha256":"1d9d0b210938322b805e1c8d94db07f45ca029fc4e69fb3a57f424eb885c1a39","import_time":"2026-05-26T05:51:20.950446377Z","id":"IN-MAL-2026-003805","modified_time":"2026-05-21T12:28:01Z","versions":["3.9.9"]},{"source":"amazon-inspector","sha256":"c0b86b47904b349a2e1215249ecac574cf16e96af29ca368ec929ae9ecaac151","import_time":"2026-06-12T19:44:04.966269539Z","id":"IN-MAL-2026-006075","modified_time":"2026-06-12T19:08:12Z","versions":["4.0.6"]},{"source":"amazon-inspector","sha256":"d20ccd8aeb5a7189ddbf4b3aa9806035fad27f0e07796f5a051e2293c06a770d","import_time":"2026-06-12T19:44:05.084275827Z","id":"IN-MAL-2026-006076","modified_time":"2026-06-12T19:08:14Z","versions":["4.0.7"]},{"source":"amazon-inspector","sha256":"0b82a9d3071d50ffb4b6280c9ddd502995f71e2d649378921a74693caea37c68","import_time":"2026-06-12T19:44:05.37979308Z","id":"IN-MAL-2026-006079","modified_time":"2026-06-12T19:08:19Z","versions":["4.1.3"]},{"source":"amazon-inspector","sha256":"268d4a1df99e96db1ebec9a5a8da35d9ba246fdbe387f95eb91bef21e3f8634f","import_time":"2026-06-12T19:44:05.182644456Z","id":"IN-MAL-2026-006077","modified_time":"2026-06-12T19:08:15Z","versions":["4.0.9"]},{"source":"amazon-inspector","sha256":"8cb587efe462ac7a330bc0ba14e2938d0f3ece61c968b2ac35a8c65b1338889e","import_time":"2026-06-12T19:44:04.85894703Z","id":"IN-MAL-2026-006074","modified_time":"2026-06-12T19:08:10Z","versions":["4.0.5"]},{"source":"amazon-inspector","sha256":"8dc70de904401a2a736376ce397178431485e593f654c341fd1ac3b46b553c63","import_time":"2026-06-12T19:44:04.772651242Z","id":"IN-MAL-2026-006073","modified_time":"2026-06-12T19:08:09Z","versions":["4.0.4"]},{"source":"amazon-inspector","sha256":"9cc68edfd3f754d1c8a3c655575082875be153edcef13f8a28f497c6474761aa","import_time":"2026-06-12T19:44:05.275052582Z","id":"IN-MAL-2026-006078","modified_time":"2026-06-12T19:08:17Z","versions":["4.1.2"]},{"source":"amazon-inspector","sha256":"723366ee414cfd3c31b382dd85427947dddaef6ebeaad37d7f1902ab6a709098","import_time":"2026-06-15T20:14:27.700679389Z","id":"IN-MAL-2026-006686","modified_time":"2026-06-15T19:50:51Z","versions":["4.1.5"]},{"source":"amazon-inspector","sha256":"9378fc9353871e75c3ac7e7a3944f175267d15db96bcba84eaa625de1d1c4986","import_time":"2026-06-18T19:20:02.294709118Z","id":"IN-MAL-2026-007018","modified_time":"2026-06-18T18:54:23Z","versions":["4.2.2"]},{"source":"amazon-inspector","sha256":"96bb71ebfc42d715b15add2c2d8366c8b94cdb21d849ef92d5f88842e5632772","import_time":"2026-06-18T19:20:02.212721286Z","id":"IN-MAL-2026-007017","modified_time":"2026-06-18T18:54:17Z","versions":["4.2.1"]}]}}