MAL-2026-16006

    Dashboard / Malicious Package / MAL-2026-16006

    MAL-2026-16006

    Published: 6 Sept 2026Last Modified: 8 Sept 2026

    Summary: Malicious code in vishal_312pkg (npm)

    Details: Source: amazon-inspector (74d38dada8ec3921b4a3f69e7d44b5f5b54d345ff8f9581d34007a3e68679da4) package.json declares a preinstall lifecycle script that runs on `npm install` and issues a wget request to https://webhook.site/ea0ca859-424d-4cc5-9210-62f7e25692a1/ carrying the installer's username ($(whoami)), current working directory ($(pwd)), and hostname ($(hostname)) as querystring parameters. The destination is a third-party request-inspection collector hardcoded in the manifest, unrelated to any documented package purpose. This is the canonical dependency-confusion / reconnaissance beacon shape: automatic execution at install time, unconditional outbound network to an attacker-controlled endpoint, and disclosure of installer host identifiers that identify internal environments and users. Source: ossf-package-analysis (a0c8bd63b24097ddfa37be2a0c26450b21d7963a77c5bd81bc4892b89490d51b) The OpenSSF Package Analysis project identified 'vishal_312pkg' @ 1.0.0 (npm) as malicious. It is considered malicious because: - The package executes one or more commands associated with malicious behavior.

    References: https://www.npmjs.com/package/vishal_312pkg/v/1.0.0

    Affected packages

    Package

    Name: vishal_312pkg

    Purl: pkg:npm/vishal_312pkg

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.0
    MAL-2026-16006 | CVE-DB