MAL-2026-16206

    Dashboard / Malicious Package / MAL-2026-16206

    MAL-2026-16206

    Published: 16 Sept 2026Last Modified: 16 Sept 2026

    Summary: Malicious code in @prime0/pcomatch (npm)

    Details: Source: amazon-inspector (08299e41eb4feb9e324854bf5cd3386e6e52696b4b11443254374897a1ad3816) index.js and the postinstall lifecycle script contact a hardcoded bare-IP endpoint at http://69.48.229.140:8080 over plain HTTP. On `npm install`, the postinstall hook collects host identifiers (hostname, username, platform, arch, cwd, node version, pid, all non-internal IP addresses, uptime, package name) and POSTs them as JSON to /b. On `require()` of the package main, the module beacons the same host, then polls /c every 30 seconds for JSON commands and executes the `c` field via child_process.exec, POSTing stdout/stderr back to /r. A source comment self-identifies the module as a stealth typosquat agent, while package.json advertises only a generic "small utility" description.

    References: https://www.npmjs.com/package/@prime0/pcomatch/v/1.0.0

    Affected packages

    Package

    Name: @prime0/pcomatch

    Purl: pkg:npm/%40prime0/pcomatch

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.0