MAL-2026-4685

    Dashboard / Malicious Package / MAL-2026-4685

    MAL-2026-4685

    Published: 25 May 2026Last Modified: 26 May 2026

    Summary: Malicious code in tempo-components (npm)

    Details: Source: amazon-inspector (6790e6e83af71238b9773ae49568f5374d094d23d1a7247ef4560d645ef64024) The package contains a file (poc.js) that imports os, https, fs, and child_process; collects host identifiers including os.hostname(), os.platform(), and the output of `whoami`; and POSTs the data via https.request to an external endpoint. This is a classic system-reconnaissance and exfiltration shape with no benign interpretation for a package distributed under a 'components' name. Installing or loading this code on a build or developer machine causes host metadata and identity information to be transmitted off-host.

    References: https://www.npmjs.com/package/tempo-components/v/99.0.1

    Affected packages

    Package

    Name: tempo-components

    Purl: pkg:npm/tempo-components

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    99.0.1
    MAL-2026-4685 | CVE-DB