MAL-2026-13975

    Dashboard / Malicious Package / MAL-2026-13975

    MAL-2026-13975

    Published: 13 Aug 2026Last Modified: 13 Aug 2026

    Summary: Malicious code in @khaznatech/utils (npm)

    Details: Source: amazon-inspector (3d6d321090b3f66b7766ca73a5cebf1a2d3ab2908d8d31f8423616c8094ec0a8) The package declares a preinstall script (install-report.js) that runs on npm install. It reads os.hostname() and the current working directory basename and sends them via https.get to a hardcoded webhook.site inbox (https://webhook.site/93b065ab-227f-4253-b940-361d00e9b870/). webhook.site is an anonymous request-inspection service that has no relation to the package's stated utilities purpose. The scoped name @khaznatech/utils combined with the unusually high version number 99.0.0 is consistent with a dependency-confusion probe designed to identify internal build systems that resolve the public name over a private one.

    References: https://www.npmjs.com/package/@khaznatech/utils/v/99.0.0

    Affected packages

    Package

    Name: @khaznatech/utils

    Purl: pkg:npm/%40khaznatech/utils

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    99.0.0
    MAL-2026-13975 | CVE-DB