MAL-2026-12478

    Dashboard / Malicious Package / MAL-2026-12478

    MAL-2026-12478

    Published: 5 Aug 2026Last Modified: 5 Aug 2026

    Summary: Malicious code in test22221 (npm)

    Details: Source: amazon-inspector (e4a3401759b5c6d7effdafcbae6027657e3cf8f9aabf1f04dfc2fa9039b64e53) package.json declares preinstall and postinstall lifecycle hooks that run on `npm install`. Both hooks curl a hardcoded bare-IP endpoint over plain HTTP at 54.37.234.136, sending the installer's username (`whoami`), hostname, current working directory, and a timestamp as query-string parameters to `http://54.37.234.136/voicemail`. The same lifecycle scripts also embed an unbounded `for((i=1;;i++))` loop that repeatedly curls incrementing paths on the same host with a 10-second sleep, functioning as a long-poll channel to the attacker-controlled endpoint during install. The destination is a bare IP with no relationship to any package publisher domain, and the collected fields are host-identification data with no legitimate purpose in an install hook.

    References: https://www.npmjs.com/package/test22221/v/2.2.7, https://www.npmjs.com/package/test22221/v/2.2.8, https://www.npmjs.com/package/test22221/v/2.2.9

    Affected packages

    Package

    Name: test22221

    Purl: pkg:npm/test22221

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    2.2.7
    2.2.8
    2.2.9