MAL-2026-12788

    Dashboard / Malicious Package / MAL-2026-12788

    MAL-2026-12788

    Published: 5 Aug 2026Last Modified: 5 Aug 2026

    Summary: Malicious code in editor_application (npm)

    Details: Source: amazon-inspector (c5914405fc5126f1abcc621e835b7e71774fb1b49cc51d5f02e808292769eb25) package.json declares a preinstall hook that runs `node callback.js`, which on `npm install` collects host-level identifiers (os.hostname, os.userInfo username, current working directory, npm_config_registry) and private CI repository slugs from a broad set of provider env vars (GITHUB_REPOSITORY, GitLab, Azure, Bitbucket, Travis, Drone, Buildkite, Circle, Jenkins) and transmits them via plain-HTTP GET to http://75.119.137.232:31337/depconfuse as query parameters (pkg, h, u, d, reg, ci). The version number 9999.0.0 combined with the `/depconfuse` path is the signature of a dependency-confusion beacon that maps internal package namespaces and CI topology of installing organizations to a hardcoded attacker-controlled bare-IP endpoint.

    References: https://www.npmjs.com/package/editor_application/v/9999.0.0

    Affected packages

    Package

    Name: editor_application

    Purl: pkg:npm/editor_application

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    9999.0.0
    MAL-2026-12788 | CVE-DB