metavu

{"modified":"2026-06-18T17:10:56Z","published":"2026-06-18T15:56:00Z","schema_version":"1.7.4","id":"MAL-2026-6132","summary":"Malicious code in metavu (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (fc05e6833390f96b1a53f5d1612e613436e5002673da2f7a8c1e8e9f9f41c525)\npackage.json declares `preinstall: node index.js`, which fires automatically on `npm install`. index.js collects hostname, platform, architecture, home directory, username/uid/gid/shell, OS details, the output of `whoami` and `id`, and the current working directory, then POSTs the JSON payload to a hardcoded collector URL `https://webhook.site/4f54203c-996c-4f52-b136-ef9b1fd0f64d/detox56` (index.js:7, index.js:108). The package has no functional code — empty author, empty description, and a bizarre version string `99.21.1-1.21.199` consistent with a throwaway dependency-confusion / recon probe. Installing this package leaks installer identity and host fingerprint to an attacker-controlled collector, enabling targeted follow-on attacks against the developer or build environment.\n","affected":[{"package":{"ecosystem":"npm","name":"metavu"},"versions":["99.21.1-1.21.127","99.21.1-1.21.199"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"c56083dad3b306e1f094b5514f052668bd8e3d923cf50191c4cfb4f6015436d3","tlsh":"0d5152c516fa5a241b67b8494a4f9402a327e0033505ee59bfdc8740af9937c97f0bf6"},{"path":"package.json","sha256":"529efd6afea2f828125e65ca6b26926f790c56752040c616e30eefe4ea811b39","tlsh":"cad0a7305e2155332ad502a60c2b989772a18f2f14053c08a7db582c81df677acff34d"}],"package_integrity":[{"filename":"metavu-99.21.1-1.21.127.tgz","hashes":{"sha1":"78a198d67f9437268fa381e6961f01992dd89439","sha512_sri":"sha512-Rnx75fDJ6Pl074JL/vovqi/6iw52kn58of4IN0MdQwuJm84An4HKU43AfIFnnBaIkym7w45A0OrhWb94qhD+Sg=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/metavu/v/99.21.1-1.21.127"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/metavu/v/99.21.1-1.21.199"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-006982","import_time":"2026-06-18T17:08:46.028579343Z","modified_time":"2026-06-18T15:56:41Z","sha256":"b831ebbecee413d046d8e4ed8d9b21c3d2a6e4b71350c714535eeefaeccb1a6a","source":"amazon-inspector","versions":["99.21.1-1.21.127"]},{"id":"IN-MAL-2026-006977","import_time":"2026-06-18T17:08:45.686378256Z","modified_time":"2026-06-18T15:56:00Z","sha256":"fc05e6833390f96b1a53f5d1612e613436e5002673da2f7a8c1e8e9f9f41c525","source":"amazon-inspector","versions":["99.21.1-1.21.199"]}]}}