MAL-2026-10493

    Dashboard / Malicious Package / MAL-2026-10493

    MAL-2026-10493

    Published: 13 Jul 2026Last Modified: 13 Jul 2026

    Summary: Malicious code in insomnia-plugin-poc-m4gester-run (npm)

    Details: Source: amazon-inspector (38a525aea57681df6c21035b723701fa6067f091fd81ac26bb3fcc8e2126c43e) package.json declares a postinstall lifecycle hook that runs `calc.exe` on the installer's machine during `npm install`. The main entry point exports only an empty `requestHooks` array, providing no actual Insomnia plugin functionality — the package's sole effect is the arbitrary command execution at install time. The name self-identifies as a proof-of-concept and mimics the Insomnia plugin naming convention with a leet-substituted variant, indicating the package exists solely to demonstrate/exploit install-time RCE. While calc.exe itself is benign, the postinstall hook establishes full arbitrary-command-execution capability against any developer installing the package on Windows.

    References: https://www.npmjs.com/package/insomnia-plugin-poc-m4gester-run/v/1.0.0

    Affected packages

    Package

    Name: insomnia-plugin-poc-m4gester-run

    Purl: pkg:npm/insomnia-plugin-poc-m4gester-run

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.0
    MAL-2026-10493 | CVE-DB