MAL-2026-13742

    Dashboard / Malicious Package / MAL-2026-13742

    MAL-2026-13742

    Published: 11 Aug 2026Last Modified: 11 Aug 2026

    Summary: Malicious code in zeal-rq-hooks (npm)

    Details: Source: amazon-inspector (dcf7e926ec85f72f362263a19d4f99c4b215ddd94ed4454c669c3387cacee164) The package includes canary.js which imports os/http/https and, at line 123, POSTs a JSON body containing os.hostname(), os.userInfo(), process.platform, node/npm version, and cwd to the hardcoded endpoint https://npm-canary.aveliscare.com. The hostname is not associated with the npm registry or a documented publisher and is embedded directly in the package's own shipped code. The collected fields (hostname, username, platform, cwd) are host-identifying reconnaissance data, and the network destination is not user-configurable in the flagged code path.

    References: https://www.npmjs.com/package/zeal-rq-hooks/v/0.0.0

    Affected packages

    Package

    Name: zeal-rq-hooks

    Purl: pkg:npm/zeal-rq-hooks

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    0.0.0
    MAL-2026-13742 | CVE-DB