MAL-2026-16312

    Dashboard / Malicious Package / MAL-2026-16312

    MAL-2026-16312

    Published: 21 Sept 2026Last Modified: 21 Sept 2026

    Summary: Malicious code in test1df23 (npm)

    Details: Source: amazon-inspector (67708642854d76da722a8130de47a8fb7fd23f0035cf646f1bf16d97419e5756) package.json declares preinstall and postinstall hooks that execute index.js on npm install. index.js issues an HTTP GET to the hardcoded bare IP 128.199.122.145 over plain HTTP, with the package name embedded in the query string (http://128.199.122.145/?test1df23). The beacon fires automatically at install time, leaking the installer's outbound IP and confirming successful execution on the installer's host to the operator of that IP. The package name and near-empty payload are consistent with a dependency-confusion or typosquat probe.

    References: https://www.npmjs.com/package/test1df23/v/99.99.99

    Affected packages

    Package

    Name: test1df23

    Purl: pkg:npm/test1df23

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    99.99.99