veteran

{"modified":"2026-06-12T19:46:17Z","published":"2026-05-21T16:28:03Z","schema_version":"1.7.4","id":"MAL-2026-4703","summary":"Malicious code in veteran (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (70a20dd9f8d6a9df01d766c25693711d90e4303e3c68fa371f0b842f83c485b4)\nOn `npm install`, the package's postinstall hook (`install.js`, registered via `package.json` line 10 `\"postinstall\": \"node install.js\"`) downloads a platform-specific executable from `https://laogou.us/download/veteran/v1.0.0/veteran_1.0.0_<platform>_<arch>.{tar.gz,zip}` (install.js:13 `const DOWNLOAD_BASE_URL = 'https://laogou.us/download/veteran'`), extracts it via shell `tar`/`unzip`, `chmod 0o755`s it (install.js:165), and immediately executes it (install.js:170 `execSync(\"${BIN_PATH}\" version\",...)`). The download host `laogou.us` does not match the package's declared publisher/homepage (`github.com/yongjie0203/veteran`); the URL is not version-pinned to a hash or signature; no checksum or signature verification is performed on the fetched bytes; and source comments suggest the URL is meant to be swapped by future maintainers. The operator of `laogou.us` can therefore serve arbitrary native code to every installer, with the bytes executed under the installer's user on `npm install`. This matches the publisher-mismatched, unverified, mutable-host dropper pattern.\n","affected":[{"package":{"ecosystem":"npm","name":"veteran"},"versions":["1.0.5","1.0.3","1.0.11"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"domains":["laogou.us"],"evidence_files":[{"path":"install.js","sha256":"3426e013b778c090d500dd32edb24ebd51bc8a508c0a34d2b8ac42a5d5fe2e67","tlsh":"d9d176c95af3923147b3519a574b2412722b80132509da9c7aad83587fa2f64c1a27ff"}],"package_integrity":[{"filename":"veteran-1.0.5.tgz","hashes":{"sha1":"0052d8a2de42bc9f2899a68e58c9891116c1e26f","sha512_sri":"sha512-CvuPok1uJTY3yRHpvfTqlEcgSiSrNZV1PklJRMs74My+NjL/zTO1wXU5t5xzm2V2CXmJaIwVNtEBtj8qdSMiSQ=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/veteran/v/1.0.5"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/veteran/v/1.0.3"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/veteran/v/1.0.11"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["actran@amazon.com","inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"source":"amazon-inspector","sha256":"2090d10d814f7a007b22aef6b4a02f936d6aa7c4d6aa3e33119cb4790b7a1cc7","import_time":"2026-05-26T05:52:07.751401281Z","id":"IN-MAL-2026-004199","modified_time":"2026-05-22T12:08:42Z","versions":["1.0.5"]},{"source":"amazon-inspector","sha256":"32d36199543a5734d26e7afa06931d745a1bc1e45b6e381cf0b6de00569bec33","import_time":"2026-05-26T05:51:32.946530679Z","id":"IN-MAL-2026-003903","modified_time":"2026-05-21T16:28:04Z","versions":["1.0.3"]},{"source":"amazon-inspector","sha256":"70a20dd9f8d6a9df01d766c25693711d90e4303e3c68fa371f0b842f83c485b4","import_time":"2026-05-26T05:51:32.837610855Z","id":"IN-MAL-2026-003902","modified_time":"2026-05-21T16:28:03Z","versions":["1.0.3"]},{"source":"amazon-inspector","sha256":"8a0b963f374ca64c5f3c294b3479ec208aa4c4fd28e2fcc536f0a40f46589fe4","import_time":"2026-05-26T05:52:07.866508734Z","id":"IN-MAL-2026-004200","modified_time":"2026-05-22T12:08:42Z","versions":["1.0.5"]},{"source":"amazon-inspector","sha256":"8bfccafcb2db4d6b3085202a767e060929a7c580172cbfbd2c24511b4207099b","import_time":"2026-06-12T19:43:36.962518534Z","id":"IN-MAL-2026-005822","modified_time":"2026-06-12T19:02:40Z","versions":["1.0.11"]},{"source":"amazon-inspector","sha256":"e3c7d817d0894b68fd858f9e73ea8f751a06414bb4ad6b3c98a15c4b7b096a5d","import_time":"2026-06-12T19:43:36.870255714Z","id":"IN-MAL-2026-005821","modified_time":"2026-06-12T19:02:40Z","versions":["1.0.11"]}]}}