grateful-checkout

{"modified":"2026-06-09T17:47:56Z","published":"2026-06-09T17:44:52Z","schema_version":"1.7.4","id":"MAL-2026-5444","summary":"Malicious code in grateful-checkout (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (c2a9600ad3ee3fddd9f06425260c94edf660263800080787155a63d3e5212d12)\nOn `npm install`, the postinstall hook in src/canary.js performs a DNS lookup and an HTTPS GET to a serveo tunnel host (`96e03fa6c292469a-172-245-86-254.serveousercontent.com/canary-install?pkg=...&ver=...`), leaking the installer's source IP and the resolved package name/version to a third-party endpoint without consent. The package's README falsely claims that no data is collected or transmitted. The package additionally impersonates the API surface of an internal Exodus checkout-signing module (`generateMnemonicSigningKeys`, `signDirectPaymentMultiChain`, `signCapture`, `signRefund`, `signCharge`, `signCancelSubscription`) to land via dependency confusion against private name resolution. While self-described as a security research PoC, the behavior — uncontracted outbound network from a lifecycle hook to a researcher-controlled tunnel and namespace impersonation of a private package — is installer-harming regardless of intent.\n","affected":[{"package":{"ecosystem":"npm","name":"grateful-checkout"},"versions":["99.0.0-canary.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"domains":["96e03fa6c292469a-172-245-86-254.serveousercontent.com"],"evidence_files":[{"path":"src/canary.js","sha256":"16502b9065d4976ebb34fd49d0fb75f3cd0e64cf8d35872b419a6b6752485d51","tlsh":"37e06ffe4fd0a33a56701bc9f080a54fe707e3283085a2c1d69822a249c28f0ae218f0"},{"path":"src/index.js","sha256":"8df05b04ab1173592b08d71dea34f5998519f445526493f61ab3dd9dc0145a5a","tlsh":"63e07d5f0961337a1d8bd441d49794213fa2560ad0fd89a60c8d521f75035348eff0c5"}],"package_integrity":[{"filename":"grateful-checkout-99.0.0-canary.1.tgz","hashes":{"sha1":"f35d99228efe7e033866668f74f68ce1f83f0216","sha512_sri":"sha512-AU5YHWJwgf73skXr4vResekpEjCTcjkKUsuUi781cHDpg2v+BeXDrmqjeq58HvUT0yBPZioQ2JsKKSVFe1o3pw=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/grateful-checkout/v/99.0.0-canary.1"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-005118","import_time":"2026-06-09T17:45:55.450487445Z","modified_time":"2026-06-09T17:44:53Z","sha256":"09b2768ea8a2c0f9038e40a8109ae744ca38de664099bfa1fdf128790baeb67d","source":"amazon-inspector","versions":["99.0.0-canary.1"]},{"id":"IN-MAL-2026-005117","import_time":"2026-06-09T17:45:55.417984745Z","modified_time":"2026-06-09T17:44:52Z","sha256":"c2a9600ad3ee3fddd9f06425260c94edf660263800080787155a63d3e5212d12","source":"amazon-inspector","versions":["99.0.0-canary.1"]}]}}