MAL-2026-12065

    Dashboard / Malicious Package / MAL-2026-12065

    MAL-2026-12065

    Published: 5 Aug 2026Last Modified: 5 Aug 2026

    Summary: Malicious code in greatcall-customers-commandapi (npm)

    Details: Source: amazon-inspector (a2e378b27f75da210578cf8a4102023d3cbf2ab7e96a97267d73c6ffa15500c9) [email protected] is a dependency-confusion attack package. package.json self-describes as "Dependency confusion PoC" and declares preinstall, install, and postinstall lifecycle scripts all invoking `node index.js`. On any of the three install hooks, index.js collects host identifiers (os.hostname(), os.userInfo(), homedir, platform, cwd, network interfaces), captures the output of `whoami` and `ls -la` via child_process.execSync, and enumerates process.env filtering for credential-shaped keys matching /KEY|SECRET|TOKEN|PASS|AUTH|CRED|PRIVATE|AWS_|AZURE_|GCP_|GITHUB|NPM|DB_|DATABASE|API|WEBHOOK|JENKINS|OCTOPUS|CONNECTION/i, then POSTs the collected payload to a hardcoded webhook at https://test.v3n.my/pwn via https.request. The 99.0.0 version and internal-sounding name are the canonical dependency-confusion shape used to override a private registry package of the same name.

    References: https://www.npmjs.com/package/greatcall-customers-commandapi/v/99.0.0

    Affected packages

    Package

    Name: greatcall-customers-commandapi

    Purl: pkg:npm/greatcall-customers-commandapi

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    99.0.0
    MAL-2026-12065 | CVE-DB