MAL-2026-12804
Dashboard / Malicious Package / MAL-2026-12804
MAL-2026-12804
Summary: Malicious code in store-locator-widget (npm)
Details: Source: amazon-inspector (1b2ffc9f3972c8313fe78eaac2412cc8e46a693d149404736a089a18596ff7f5) [email protected] ships an empty library body (index.js exports `{}`) and a preinstall hook (`node callback.js`) that, on `npm install`, collects the installer's hostname, username, current working directory, configured npm registry, and CI project-slug environment variables (GITHUB_REPOSITORY, CI_PROJECT_PATH, BUILD_REPOSITORY_NAME, and similar) and transmits them as query-string parameters via HTTP GET to a hardcoded bare-IP endpoint at http://75.119.137.232:31337/depconfuse. The version number 9999.0.0, the placeholder description, the empty module body, and the `/depconfuse` URL path together match the dependency-confusion reconnaissance probe pattern: the package delivers no advertised functionality and its sole install-time effect is to leak information about the installer's internal package namespace and build environment to an attacker-controlled destination.
Affected packages
Package
Name: store-locator-widget
Purl: pkg:npm/store-locator-widget
Affected ranges
Type: N/A
Events:
