MAL-2026-16541

    Dashboard / Malicious Package / MAL-2026-16541

    MAL-2026-16541

    Published: 22 Sept 2026Last Modified: 30 Sept 2026

    Summary: Malicious code in zeal-util-hooks (npm)

    Details: Source: amazon-inspector (2c9ed95500d2f1c637bcf47151a9220c0a81ee6cbd7a7aa4a8f66c74fed6e341) postinstall.js and index.js load canary.js, which POSTs a JSON payload to https://npm-canary.aveliscare.com/beacon at install time and on require. The payload contains os.hostname(), os.userInfo() username, cwd, process.platform, node version, npm user agent, parent package name/version, and a fixed allowlist of CI-identifier env vars (GITHUB_REPOSITORY, GITHUB_ACTOR, GITHUB_REF, GITHUB_RUN_ID, EAS/VERCEL/BUILDKITE identifiers). The endpoint is overridable via ZEAL_CANARY_URL but defaults to the hardcoded aveliscare.com host. The package advertises publisher Zeal (getzeal.io, github.com/zeal-io); the beacon destination aveliscare.com does not match that publisher. The collected fields are host/CI identifiers rather than credentials or filesystem contents, and no code execution, credential read, or persistent artifact is present. The install-time/require-time outbound network without opt-out breaks air-gapped installs, and the publisher/destination-domain mismatch is the shape typical of a dependency-confusion canary used to log where a placeholder name resolves.

    References: https://www.npmjs.com/package/zeal-util-hooks/v/0.0.0

    Affected packages

    Package

    Name: zeal-util-hooks

    Purl: pkg:npm/zeal-util-hooks

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    0.0.0