MAL-2026-16311

    Dashboard / Malicious Package / MAL-2026-16311

    MAL-2026-16311

    Published: 21 Sept 2026Last Modified: 21 Sept 2026

    Summary: Malicious code in test12vv36 (npm)

    Details: Source: amazon-inspector (9292921d0fe368160694717f99eca753070a4249696c72b2f1bff9594cab40be) [email protected] declares both preinstall and postinstall lifecycle hooks that execute index.js on npm install. index.js issues an HTTP GET to a hardcoded bare-IP endpoint at http://128.199.122.145/?test12vv36, sending the package name in the query string and disclosing the installer's source IP to the operator of that host. The version number (99.99.99) and package.json shape (dependency on a typosquat name 'requests@^0.3.0' plus a duplicate misspelled 'Dependencies' key) are consistent with a dependency-confusion or proof-of-concept publish rather than a functional library. Installing the package causes unauthenticated, unencrypted outbound network activity to attacker-controlled infrastructure at install time, confirming successful installation on the host.

    References: https://www.npmjs.com/package/test12vv36/v/99.99.99

    Affected packages

    Package

    Name: test12vv36

    Purl: pkg:npm/test12vv36

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    99.99.99