MAL-2026-13973

    Dashboard / Malicious Package / MAL-2026-13973

    MAL-2026-13973

    Published: 13 Aug 2026Last Modified: 13 Aug 2026

    Summary: Malicious code in @khaznatech/common (npm)

    Details: Source: amazon-inspector (59ac302f60b532a4e864c576593db300a20abba96ae2a53ba5da0cc06d8dc911) The package's preinstall script (install-report.js) runs automatically on `npm install` and performs an HTTPS GET to a hardcoded webhook.site capture endpoint, appending the installer's hostname (os.hostname()) and current working directory basename (process.cwd()) to the URL path. webhook.site is an anonymous third-party request-capture service, not publisher infrastructure, and the exfiltrated values identify the installer's machine and project. The behavior is labeled as install telemetry in a comment but is not disclosed, not opt-in, and directed at an anonymous endpoint rather than a package-owned or caller-configured destination.

    References: https://www.npmjs.com/package/@khaznatech/common/v/99.0.0

    Affected packages

    Package

    Name: @khaznatech/common

    Purl: pkg:npm/%40khaznatech/common

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    99.0.0