MAL-2026-12322

    Dashboard / Malicious Package / MAL-2026-12322

    MAL-2026-12322

    Published: 5 Aug 2026Last Modified: 5 Aug 2026

    Summary: Malicious code in @mgor/fw-canary-3333 (npm)

    Details: Source: amazon-inspector (6b82e18fdadfd37a1622c522a7ca4e9ae7772b266175123dfabb8d90e3950ef6) On require of @mgor/fw-canary-3333, index.js executes a top-level shell command that curls https://fewafw.hydege.me and pipes the response into /bin/bash, running attacker-controlled shell content on the installer's host. The fetch is unpinned, unverified, and directed at a non-registry, non-publisher domain, so the executed bytes are whatever the remote host serves at request time. The package.json and README present the package as an inert canary with 'no functionality, no dependencies, and no install scripts', a cover story that directly contradicts the fetch-and-exec side effect in index.js.

    References: https://www.npmjs.com/package/@mgor/fw-canary-3333/v/0.0.1, https://www.npmjs.com/package/@mgor/fw-canary-3333/v/0.0.2

    Affected packages

    Package

    Name: @mgor/fw-canary-3333

    Purl: pkg:npm/%40mgor/fw-canary-3333

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    0.0.1
    0.0.2