MAL-2026-4360

    Dashboard / Malicious Package / MAL-2026-4360

    MAL-2026-4360

    Published: 20 May 2026Last Modified: 27 May 2026

    Summary: Malicious code in @aledan007/tester (npm)

    Details: Source: amazon-inspector (ab03e3eef2f59f358cdaacedf2d9facb12077110c5402ad36aad6e3581e66439) The bundled server file dist/server/index.js contains a hardcoded reference to the attacker-controlled domain https://evil.attacker-example.com adjacent to fetch() and POST primitives, alongside require("child_process") usage. The combination of an explicit external attacker domain wired to outbound POST/fetch calls together with child_process import is the canonical shape of an installer-side exfiltration / remote command execution payload. The destination is not a vendor/publisher domain and has no legitimate purpose; any installer requiring or running this package risks having host data and command output sent to the attacker endpoint.

    References: https://www.npmjs.com/package/@aledan007/tester/v/0.4.5

    Affected packages

    Package

    Name: @aledan007/tester

    Purl: pkg:npm/%40aledan007%2Ftester

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    0.4.5