MAL-2026-10740

    Dashboard / Malicious Package / MAL-2026-10740

    MAL-2026-10740

    Published: 16 Jul 2026Last Modified: 16 Jul 2026

    Summary: Malicious code in myreviews-core (npm)

    Details: Source: amazon-inspector (9c41d5d4352e265f0efbc0089a19c5773ceeb76c0265831eeeeca19151fe4f64) package.json declares a postinstall lifecycle hook that runs `node -e` to issue an HTTPS GET to a hardcoded webhook.site collector URL, appending the installer's hostname (`os.hostname()`), OS username (`os.userInfo().username`), current working directory (`process.cwd()`), and a timestamp as query parameters. The request fires automatically on `npm install` with no opt-in and no relation to any documented package functionality. The version number (99.0.0) is consistent with a dependency-confusion lure intended to shadow an internal package name and beacon successful installs to the attacker.

    References: https://www.npmjs.com/package/myreviews-core/v/99.0.0

    Affected packages

    Package

    Name: myreviews-core

    Purl: pkg:npm/myreviews-core

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    99.0.0
    MAL-2026-10740 | CVE-DB