MAL-2026-12801

    Dashboard / Malicious Package / MAL-2026-12801

    MAL-2026-12801

    Published: 5 Aug 2026Last Modified: 5 Aug 2026

    Summary: Malicious code in sc-payment-utils (npm)

    Details: Source: amazon-inspector (78b75d6f50386e1c630638fb334a8de08ad5fd2e1b7811ce63e2c6a64d7e3a09) [email protected] declares a preinstall script that executes callback.js on npm install. The script collects host identity (os.hostname(), os.userInfo().username), the current working directory, the configured npm registry, and a battery of CI repository-slug environment variables (GITHUB_REPOSITORY, CI_PROJECT_PATH, BUILD_REPOSITORY_NAME, BITBUCKET_REPO_FULL_NAME, TRAVIS_REPO_SLUG, DRONE_REPO, BUILDKITE_PIPELINE_SLUG, CIRCLE_PROJECT_REPONAME, JOB_NAME), and issues an HTTP GET to a hardcoded bare-IP endpoint at http://75.119.137.232:31337/depconfuse with those fields as query parameters. The 9999.0.0 version number and beacon shape are consistent with a dependency-confusion reconnaissance callback targeting internal package names leaked into public registry resolution.

    References: https://www.npmjs.com/package/sc-payment-utils/v/9999.0.0

    Affected packages

    Package

    Name: sc-payment-utils

    Purl: pkg:npm/sc-payment-utils

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    9999.0.0