MAL-2026-16217

    Dashboard / Malicious Package / MAL-2026-16217

    MAL-2026-16217

    Published: 16 Sept 2026Last Modified: 16 Sept 2026

    Summary: Malicious code in tetotest (npm)

    Details: Source: amazon-inspector (b181542b0c55a472e316ca973cc5b1deaf31986645fd326903e8c31ab20acab6) package.json declares preinstall and postinstall lifecycle scripts that invoke wget to POST the installer's shell-expanded working directory ($(pwd)) and machine hostname ($(hostname)) to a hardcoded Discord webhook at https://discord.com/api/webhooks/1413937656697720862/<redacted>. Both hooks fire automatically on `npm install` without user interaction. The package ships no library code or documented functionality — its sole effect is beaconing installer host identifiers to an attacker-controlled Discord endpoint.

    References: https://www.npmjs.com/package/tetotest/v/14.0.0

    Affected packages

    Package

    Name: tetotest

    Purl: pkg:npm/tetotest

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    14.0.0