MAL-2026-14356

    Dashboard / Malicious Package / MAL-2026-14356

    MAL-2026-14356

    Published: 21 Aug 2026Last Modified: 21 Aug 2026

    Summary: Malicious code in lumen-pages-community (npm)

    Details: Source: amazon-inspector (b7c1d6b7b99791f7bbd5999021f109bef569a6c681eda0bb6196b459b12a3808) [email protected] declares a postinstall hook (`node dc.js`) that runs automatically on `npm install`. dc.js collects the installer's hostname, username, current working directory, platform, Node version, CI environment variable, and npm user-agent, then issues an HTTPS GET to a hardcoded webhook.site collector URL (https://webhook.site/b00492c6-27ba-4ea0-a9cb-dd50b3770250/dc) with those fields as query parameters. The package name plus a 9.9.9 version and no library functionality matches the dependency-confusion shape: a high-version public namesake that catches internal-name resolution and phones home from any host that resolves it. A self-labeled 'research placeholder' framing in the package description does not change the runtime behavior — installer identifiers leave the host at install time to a third-party collector the installer did not opt into.

    References: https://www.npmjs.com/package/lumen-pages-community/v/9.9.9

    Affected packages

    Package

    Name: lumen-pages-community

    Purl: pkg:npm/lumen-pages-community

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    9.9.9
    MAL-2026-14356 | CVE-DB