MAL-2026-4527

    Dashboard / Malicious Package / MAL-2026-4527

    MAL-2026-4527

    Published: 25 May 2026Last Modified: 27 May 2026

    Summary: Malicious code in clawpro-diagnostics-metrics-cls (npm)

    Details: Source: amazon-inspector (7d176cad00849132cb8df7ca53ac064e1980cea09bfe9b25836a78b4719b08ea) The package's dist/index.js contains hardcoded HTTP POST calls targeting http://metadata.tencentyun.com along with reads of process.platform and related host identifiers. The endpoint is a cloud-metadata-style hostname being contacted over plain HTTP from package code, not a documented SDK. The package name ("diagnostics-metrics") combined with hardcoded outbound POSTs to a fixed external endpoint at module load matches the silent-beacon / data-exfiltration shape: any installer that requires this package will have host attributes transmitted to the hardcoded destination without consent or configuration.

    References: https://www.npmjs.com/package/clawpro-diagnostics-metrics-cls/v/3.0.4

    Affected packages

    Package

    Name: clawpro-diagnostics-metrics-cls

    Purl: pkg:npm/clawpro-diagnostics-metrics-cls

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    3.0.4
    MAL-2026-4527 | CVE-DB