MAL-2026-4456

    Dashboard / Malicious Package / MAL-2026-4456

    MAL-2026-4456

    Published: 20 May 2026Last Modified: 27 May 2026

    Summary: Malicious code in @thesignup/cli (npm)

    Details: Source: amazon-inspector (ba2a0430ac2be1496dc77d4ad0a94d89bcf563d4aadb4eb457812b7572aa8367) The package's scripts/postinstall.cjs runs at install time and performs host reconnaissance (hostname collection, ping/network probing) and posts the results to a remote endpoint via HTTP POST. Lifecycle-time outbound network beacons that gather host identifiers and ship them off-host on `npm install` are an active-attack shape: every installer of this package becomes a data point for the operator, with no consent and no opt-out, and the beacon fires before the user has even had a chance to read the README. The structural fingerprint (postinstall + ping + hostname read + POST to a remote host) is the canonical install-time exfiltration pattern.

    References: https://www.npmjs.com/package/@thesignup/cli/v/0.0.2

    Affected packages

    Package

    Name: @thesignup/cli

    Purl: pkg:npm/%40thesignup%2Fcli

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    0.0.2
    MAL-2026-4456 | CVE-DB