MAL-2026-5445

    Dashboard / Malicious Package / MAL-2026-5445

    MAL-2026-5445

    Published: 9 Jun 2026Last Modified: 9 Jun 2026

    Summary: Malicious code in grateful-payments (npm)

    Details: Source: amazon-inspector (1a7a07a0a09ed8037058353b9b9b067e25e3cbe783eaab8d54276d490f823471) On `npm install`, the package's postinstall script (src/canary.js) performs a DNS lookup and HTTPS GET to the hardcoded host `96e03fa6c292469a-172-245-86-254.serveousercontent.com` at path `/c`. serveousercontent.com is an anonymous reverse-tunnel service, so the destination is operator-controlled and not tied to a verifiable publisher. Every installer's machine emits an unconsented outbound network call at install time, revealing source IP, DNS resolver path, and install timing to the tunnel operator — a classic install-fleet beaconing pattern used to confirm compromise reach. The package's own metadata describes itself as a HackerOne research canary with an empty main module, but the install-time network behavior is identical to a real install-time beacon and runs on anyone who installs this version.

    References: https://www.npmjs.com/package/grateful-payments/v/99.0.0-canary.1

    Affected packages

    Package

    Name: grateful-payments

    Purl: pkg:npm/grateful-payments

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    99.0.0-canary.1
    MAL-2026-5445 | CVE-DB