MAL-2026-5733

    Dashboard / Malicious Package / MAL-2026-5733

    MAL-2026-5733

    Published: 13 Jun 2026Last Modified: 13 Jun 2026

    Summary: Malicious code in node-app-doctor (npm)

    Details: Source: amazon-inspector (addccbccd4c3c52cd67098a571ed77a4f55ea2303746f421b22b5bbf175a345e) collect.js gathers host identifiers via os.hostname() and os.homedir(), reads local filesystem state with fs.existsSync, spawns child_process commands, and POSTs the collected data to the hardcoded endpoint http://aab.sportsontheweb.net. The destination domain is unrelated to any legitimate npm/Node tooling publisher and there is no plausible benign reason for a 'node app doctor' utility to ship installer/host telemetry to that host. The combination of system enumeration (hostname, home directory, child_process), filesystem inspection, and hardcoded plaintext HTTP POST to an unaffiliated domain is the standard host-fingerprint exfiltration shape.

    References: https://www.npmjs.com/package/node-app-doctor/v/1.0.9, https://www.npmjs.com/package/node-app-doctor/v/1.0.1, https://www.npmjs.com/package/node-app-doctor/v/1.0.2

    Affected packages

    Package

    Name: node-app-doctor

    Purl: pkg:npm/node-app-doctor

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.9
    1.0.2
    1.0.1
    MAL-2026-5733 | CVE-DB