MAL-2026-6553

    Dashboard / Malicious Package / MAL-2026-6553

    MAL-2026-6553

    Published: 28 Jun 2026Last Modified: 28 Jun 2026

    Summary: Malicious code in insomnia-plugin-poc-m4gester2 (npm)

    Details: Source: amazon-inspector (1b2b63f22e7d0d8f23c608a3c109163e06e2bd6a1dd716305e0d8adaf6be6b86) Package ships only a package.json with no plugin code, declaring a postinstall lifecycle script that runs `echo PWNED_BY_DEEPLINK > /tmp/pwned.txt` on every `npm install`. This writes a marker file to the installer's filesystem and demonstrates arbitrary command execution at install time. The package name self-identifies as a proof-of-concept (`poc-m4gester`) and adopts the `insomnia-plugin-*` namespace despite shipping no Insomnia plugin functionality. While the current payload is a benign marker write, the postinstall is an arbitrary-shell-on-install primitive with no legitimate purpose, in a namespace-squat shell of a package.

    References: https://www.npmjs.com/package/insomnia-plugin-poc-m4gester2/v/1.0.1, https://www.npmjs.com/package/insomnia-plugin-poc-m4gester2/v/1.0.0

    Affected packages

    Package

    Name: insomnia-plugin-poc-m4gester2

    Purl: pkg:npm/insomnia-plugin-poc-m4gester2

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 0
    Fixed -None

    Affected versions

    1.0.1
    1.0.0
    MAL-2026-6553 | CVE-DB