MAL-2026-16151

    Dashboard / Malicious Package / MAL-2026-16151

    MAL-2026-16151

    Published: 14 Sept 2026Last Modified: 17 Sept 2026

    Summary: Malicious code in sql-limit-enforcer (npm)

    Details: Source: amazon-inspector (6f8126bab8131e5781af023537f7c5fc2456929c104f71312eeddcea358b5659) Package ships no legitimate functionality: package.json declares main=index.js which is absent from the tarball, and the only shipped source is main.js, which runs from a postinstall hook (`node main.js`) during `npm install`. main.js collects host identifiers via require('os') — os.hostname(), os.userInfo(), os.platform(), os.arch(), process.cwd(), process.version — and POSTs them as JSON over https to the hardcoded collector URL https://webhook.site/13d98b4a-1999-4ec7-92c9-0697c259ca05. The declared purpose (SQL limit enforcer) is a cover; the artifact is an install-time reconnaissance beacon.

    References: https://www.npmjs.com/package/sql-limit-enforcer/v/10.0.0, https://www.npmjs.com/package/sql-limit-enforcer/v/10.0.1, https://www.npmjs.com/package/sql-limit-enforcer/v/10.0.2

    Affected packages

    Package

    Name: sql-limit-enforcer

    Purl: pkg:npm/sql-limit-enforcer

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    10.0.0
    10.0.1
    10.0.2