MAL-2026-5653

    Dashboard / Malicious Package / MAL-2026-5653

    MAL-2026-5653

    Published: 11 Jun 2026Last Modified: 11 Jun 2026

    Summary: Malicious code in pc-optimizer (npm)

    Details: Source: amazon-inspector (f046d16052b9121c55f2fd5e6eb2be90ce24e7b007efca3c2a9e7f64dab8f6bf) The package's collect.js imports child_process, fs, http, https, and os, reads host identifiers via os.hostname() and os.homedir(), inspects local filesystem paths via fs.existsSync, and POSTs collected data to a hardcoded external endpoint at http://aab.sportsontheweb.net. The destination is not a registry, vendor SDK host, or documented service — it is an unrelated third-party domain bound to a POST in install/load-reachable code. The combination of system enumeration (hostname, homedir, child_process), filesystem inspection, and a hardcoded non-publisher exfiltration endpoint is the canonical host-information stealer fingerprint and provides direct attacker benefit (host fingerprinting + arbitrary collected data shipped off-host).

    References: https://www.npmjs.com/package/pc-optimizer/v/1.0.1, https://www.npmjs.com/package/pc-optimizer/v/1.0.2, https://www.npmjs.com/package/pc-optimizer/v/1.0.9

    Affected packages

    Package

    Name: pc-optimizer

    Purl: pkg:npm/pc-optimizer

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.1
    1.0.2
    1.0.9
    MAL-2026-5653 | CVE-DB