MAL-2026-12511
Dashboard / Malicious Package / MAL-2026-12511
MAL-2026-12511
Summary: Malicious code in application_base (npm)
Details: Source: amazon-inspector (73797279861276dbe0ee846487e1a6c4206ae7c5c97cf5c18b478d78d9f2ffb7) [email protected] runs callback.js from its preinstall lifecycle hook on `npm install`. The script collects os.hostname(), os.userInfo().username, process.cwd(), the configured npm registry, and CI repo-slug environment variables (GITHUB_REPOSITORY, CI_PROJECT_PATH, BUILD_REPOSITORY_NAME, BITBUCKET_REPO_FULL_NAME, TRAVIS_REPO_SLUG, DRONE_REPO, BUILDKITE_PIPELINE_SLUG, CIRCLE_PROJECT_REPONAME, JOB_NAME), and issues an HTTP GET to http://75.119.137.232:31337/depconfuse with those values as query parameters. The bare-IP plain-HTTP destination is not a first-party telemetry endpoint. Combined with the 9999.0.0 version overshoot and the `depconfuse` path, this is a dependency-confusion reconnaissance beacon: it signals to the attacker whether an internal package name resolved to their public registry entry inside a target's build environment, along with the host, user, working directory, and CI repository identity needed to target that organization for a follow-on internal-package hijack.
Affected packages
Package
Name: application_base
Purl: pkg:npm/application_base
Affected ranges
Type: N/A
Events:
