MAL-2026-16417

    Dashboard / Malicious Package / MAL-2026-16417

    MAL-2026-16417

    Published: 22 Sept 2026Last Modified: 23 Sept 2026

    Summary: Malicious code in eslint-config-compact-utils (npm)

    Details: Source: amazon-inspector (414c7f8397efb591ffe6f87f9c44e8eb803606eb4789d357abe337d3225cc46f) On require, index.js collects host reconnaissance data (os.hostname(), os.userInfo().username, os.platform(), architecture, Node version, current working directory) together with CI/repository environment variables (CI, RUNNER_NAME, GITHUB_REPOSITORY) and sends them as query parameters via https.get to the hardcoded endpoint https://cbrsuo9293.execute-api.us-east-1.amazonaws.com/c. The exfiltration fires as a side effect of importing the module and is unrelated to the package's advertised ESLint configuration purpose. The shape (import-time beacon carrying host identity plus CI/repo identifiers to a non-first-party AWS API Gateway) is consistent with dependency-confusion / typosquat reconnaissance. Source: ossf-package-analysis (bc5522528e8b5b20c598dc3047008916fc237ee068e6e1a24d8709ee5d451de5) The OpenSSF Package Analysis project identified 'eslint-config-compact-utils' @ 1.0.0 (npm) as malicious. It is considered malicious because: - The package executes one or more commands associated with malicious behavior.

    References: https://www.npmjs.com/package/eslint-config-compact-utils/v/1.0.2

    Affected packages

    Package

    Name: eslint-config-compact-utils

    Purl: pkg:npm/eslint-config-compact-utils

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.2
    1.0.0