MAL-2026-12512
Dashboard / Malicious Package / MAL-2026-12512
MAL-2026-12512
Summary: Malicious code in appsignal (npm)
Details: Source: amazon-inspector (ff26e8c679b4035612af78043157ee418aac37aab4eebc5ba54a6e60f204e95c) Package name `appsignal` shadows the legitimate `@appsignal/*` scope and is published at version `9999.0.0`, a version-number pattern used to outrank private/internal dependencies during resolution. A `preinstall` script runs automatically on `npm install` and issues an HTTP GET to the hardcoded bare-IP endpoint `http://75.119.137.232:31337/depconfuse`, carrying the installer's `os.hostname()`, `os.userInfo().username`, `process.cwd()`, `npm_config_registry`, and CI repository-slug environment variables (`GITHUB_REPOSITORY`, `CI_PROJECT_PATH`, `BUILD_REPOSITORY_NAME`, `BITBUCKET_REPO_FULL_NAME`, `TRAVIS_REPO_SLUG`, `DRONE_REPO`, `BUILDKITE_PIPELINE_SLUG`, `CIRCLE_PROJECT_REPONAME`, `JOB_NAME`) as query parameters. The endpoint path `/depconfuse`, the bare-IP destination, the `9999.0.0` version, and the shadowing of an established scope indicate a dependency-confusion reconnaissance probe designed to identify internal build systems that resolve the public name over an intended private package.
Affected packages
Package
Name: appsignal
Purl: pkg:npm/appsignal
Affected ranges
Type: N/A
Events:
