MAL-2026-4637

    Dashboard / Malicious Package / MAL-2026-4637

    MAL-2026-4637

    Published: 23 May 2026Last Modified: 26 May 2026

    Summary: Malicious code in pewter-constants (npm)

    Details: Source: amazon-inspector (3c9f898fe8ed95b1d549bfff91d7c0dda0f75ada1c32a58af144940cf28b23c5) On `npm install`, a preinstall hook in callback.js collects os.hostname(), os.userInfo().username, process.cwd(), the configured npm registry (`npm_config_registry`), and CI repo identifiers (GITHUB_REPOSITORY, CI_PROJECT_PATH, BUILD_REPOSITORY_NAME) and HTTP-GETs them to `http://75.119.137.232:31337/depconfuse`. The package is shaped as a dependency-confusion squat: version `9999.0.0` to win semver resolution against an internal package of the same name, an empty `index.js` (`module.exports = {}`), and placeholder author/description metadata (`Security Researcher`, `Security research placeholder`). Any build that resolves `pewter-constants` from the public registry will install this package and silently leak its internal registry URL, CI repo path, and host/user identity to a third-party operator over plain HTTP. The 'security research' framing in the metadata does not change the installer-side impact — internal infrastructure is fingerprinted and disclosed without consent.

    Affected packages

    Package

    Name: pewter-constants

    Purl: pkg:npm/pewter-constants

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    9999.0.0
    MAL-2026-4637 | CVE-DB