MAL-2026-6065

    Dashboard / Malicious Package / MAL-2026-6065

    MAL-2026-6065

    Published: 17 Jun 2026Last Modified: 17 Jun 2026

    Summary: Malicious code in lab-services (npm)

    Details: Source: amazon-inspector (4acaa72e3c14b79785540c878cb48f7a0cdc238d20ac9cebd6ffdd42061f6e7b) On `npm install`, the package's preinstall lifecycle script (node.js) collects host identifiers from the installing machine — hostname, public IP (resolved via api.ipify.org), current working directory, OS platform, and architecture — and POSTs them to a hardcoded Discord webhook at discord.com/api/webhooks/1516798168304586833/. The behavior fires automatically with no opt-in and no user interaction. The package is published at version 99.0.0 with a description self-identifying as an 'Authorized Security Research PoC - Dependency Confusion Assessment' and keywords including 'bugbounty', 'msrc', 'security-holding' — the structural shape of a dependency-confusion squat against an internal package name of the same identifier. Regardless of researcher intent, the public publication causes any installer who resolves this name (including unrelated organizations or accidental typo-installs) to leak internal network metadata to a third-party webhook.

    References: https://www.npmjs.com/package/lab-services/v/99.0.0

    Affected packages

    Package

    Name: lab-services

    Purl: pkg:npm/lab-services

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    99.0.0