MAL-2026-4686

    Dashboard / Malicious Package / MAL-2026-4686

    MAL-2026-4686

    Published: 25 May 2026Last Modified: 26 May 2026

    Summary: Malicious code in tempo-layout (npm)

    Details: Source: amazon-inspector (795bf7080d27cef141114dd46b5734c136f762933a43f2d1308e82547c5f99a6) [email protected] ships a preinstall hook (poc.js) that unconditionally collects host identity (os.hostname, whoami, id), network configuration (ipconfig/ip a/resolv.conf), git remote, parent package.json, CI pipeline files (.gitlab-ci.yml,.github/workflows, Jenkinsfile, azure-pipelines.yml), and a filtered sweep of environment variables matching TOKEN/AWS/AZURE/NPM/GITHUB/GITLAB/JENKINS/WALMART/CI_/BUILD prefixes. The collected JSON is POSTed over HTTPS to a hardcoded interactsh subdomain (d8a5d9pon5bugoc35cngp9hcregcqyezu.oast.me) on `npm install`. The package additionally self-identifies as a dependency-confusion proof-of-concept targeting an internal namespace (@livingdesign/react) and is published to the public npm registry so any organization whose resolver falls through to public npm receives the payload. Regardless of any bug-bounty framing in the metadata, the published artifact harvests installer credentials and CI tokens and ships them off-host on install — this is an installer-side supply-chain attack.

    References: https://www.npmjs.com/package/tempo-layout/v/99.0.1, https://www.npmjs.com/package/tempo-layout/v/99.0.2, https://www.npmjs.com/package/tempo-layout/v/99.0.0

    Affected packages

    Package

    Name: tempo-layout

    Purl: pkg:npm/tempo-layout

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    99.0.1
    99.0.0
    99.0.2
    MAL-2026-4686 | CVE-DB