MAL-2026-5794

    Dashboard / Malicious Package / MAL-2026-5794

    MAL-2026-5794

    Published: 15 Jun 2026Last Modified: 15 Jun 2026

    Summary: Malicious code in neural-network-scan (npm)

    Details: Source: amazon-inspector (898c75e5a6ae94d115820736ffd2ca4cb948f72655d5c0175a3432cec835768c) The package ships a collect.js script that imports child_process and performs an HTTP POST carrying host identifiers (hostname referenced multiple times in the same file alongside the POST sink). This pattern — child_process + hostname collection + outbound POST in a non-functional 'scan' utility — matches the host-reconnaissance / data-exfiltration shape used by dependency-confusion and recon-beacon packages. The package name and minimal surface are consistent with a recon lure rather than a useful library. Installing or requiring this package causes installer host data to be sent to an external endpoint.

    References: https://www.npmjs.com/package/neural-network-scan/v/1.0.9, https://www.npmjs.com/package/neural-network-scan/v/1.0.2, https://www.npmjs.com/package/neural-network-scan/v/1.0.8, https://www.npmjs.com/package/neural-network-scan/v/1.0.1

    Affected packages

    Package

    Name: neural-network-scan

    Purl: pkg:npm/neural-network-scan

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.9
    1.0.2
    1.0.8
    1.0.1
    MAL-2026-5794 | CVE-DB