MAL-2026-5444

    Dashboard / Malicious Package / MAL-2026-5444

    MAL-2026-5444

    Published: 9 Jun 2026Last Modified: 9 Jun 2026

    Summary: Malicious code in grateful-checkout (npm)

    Details: Source: amazon-inspector (c2a9600ad3ee3fddd9f06425260c94edf660263800080787155a63d3e5212d12) On `npm install`, the postinstall hook in src/canary.js performs a DNS lookup and an HTTPS GET to a serveo tunnel host (`96e03fa6c292469a-172-245-86-254.serveousercontent.com/canary-install?pkg=...&ver=...`), leaking the installer's source IP and the resolved package name/version to a third-party endpoint without consent. The package's README falsely claims that no data is collected or transmitted. The package additionally impersonates the API surface of an internal Exodus checkout-signing module (`generateMnemonicSigningKeys`, `signDirectPaymentMultiChain`, `signCapture`, `signRefund`, `signCharge`, `signCancelSubscription`) to land via dependency confusion against private name resolution. While self-described as a security research PoC, the behavior — uncontracted outbound network from a lifecycle hook to a researcher-controlled tunnel and namespace impersonation of a private package — is installer-harming regardless of intent.

    References: https://www.npmjs.com/package/grateful-checkout/v/99.0.0-canary.1

    Affected packages

    Package

    Name: grateful-checkout

    Purl: pkg:npm/grateful-checkout

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    99.0.0-canary.1
    MAL-2026-5444 | CVE-DB