MAL-2026-16218

    Dashboard / Malicious Package / MAL-2026-16218

    MAL-2026-16218

    Published: 15 Sept 2026Last Modified: 16 Sept 2026

    Summary: Malicious code in tol8t (npm)

    Details: Source: amazon-inspector (c33f4cd3c64d0ca0eb65dc5947fce3700c94ec8bea6083e63da1e6ba31321e27) package.json declares preinstall and postinstall lifecycle hooks that use wget to POST installer host identifiers to a hardcoded Discord webhook at https://discord.com/api/webhooks/1413937656697720862/. The preinstall hook sends the installer's current working directory ($(pwd)) and the postinstall hook sends the machine hostname ($(hostname)). Both fire automatically during `npm install` with no user interaction. The package ships no other functionality; its sole behavior is host reconnaissance beaconing to an attacker-controlled Discord webhook. Source: ossf-package-analysis (2f9850f64422a733207e07792098b0e3c72d43311f73a44bd07ae0c2dd4429eb) The OpenSSF Package Analysis project identified 'tol8t' @ 14.0.0 (npm) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity. - The package executes one or more commands associated with malicious behavior.

    References: https://www.npmjs.com/package/tol8t/v/14.0.0

    Affected packages

    Package

    Name: tol8t

    Purl: pkg:npm/tol8t

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    14.0.0