tempo-components

{"modified":"2026-05-26T05:55:04Z","published":"2026-05-25T14:15:47Z","schema_version":"1.7.4","id":"MAL-2026-4685","summary":"Malicious code in tempo-components (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (6790e6e83af71238b9773ae49568f5374d094d23d1a7247ef4560d645ef64024)\nThe package contains a file (poc.js) that imports os, https, fs, and child_process; collects host identifiers including os.hostname(), os.platform(), and the output of `whoami`; and POSTs the data via https.request to an external endpoint. This is a classic system-reconnaissance and exfiltration shape with no benign interpretation for a package distributed under a 'components' name. Installing or loading this code on a build or developer machine causes host metadata and identity information to be transmitted off-host.\n","affected":[{"package":{"ecosystem":"npm","name":"tempo-components"},"versions":["99.0.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"domains":["tempo-components-7363616e2d36313333363566633561.d8a5d9pon5bugoc35cngp9hcregcqyezu.oast.me","d8a5d9pon5bugoc35cngp9hcregcqyezu.oast.me"],"evidence_files":[{"path":"poc.js","sha256":"47b3f821e4bb957a801afa370619987e7535f8527cc245deb5e555e85eff58d5","tlsh":"d671c7d482fa1e3022aa75b1b5cd040522d7d3933246f9d4798c1a919f9f8b482f67be"}],"package_integrity":[{"filename":"tempo-components-99.0.1.tgz","hashes":{"sha1":"1dd86abc7f3a1262803a2740f5ec3d5e36a20938","sha512_sri":"sha512-Okl8VvweZsIzEMMpromguPoBh2Z7AX8BWdje0yBGlP5Blu0ske8NSFXoSRkjdBDoOgvSgcKJNHgdHTUH863Q0g=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/tempo-components/v/99.0.1"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["actran@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-004682","import_time":"2026-05-26T05:53:04.778599014Z","modified_time":"2026-05-25T14:15:47Z","sha256":"6790e6e83af71238b9773ae49568f5374d094d23d1a7247ef4560d645ef64024","source":"amazon-inspector","versions":["99.0.1"]},{"id":"IN-MAL-2026-004683","import_time":"2026-05-26T05:53:04.869125864Z","modified_time":"2026-05-25T14:15:48Z","sha256":"9f516fddd52133764a3ff124d5ec3f47b7327e7f6df709614b6040dc4eb35b3c","source":"amazon-inspector","versions":["99.0.1"]}]}}