Malicious code in test22221 (npm)
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (e4a3401759b5c6d7effdafcbae6027657e3cf8f9aabf1f04dfc2fa9039b64e53) package.json declares preinstall and postinstall lifecycle hooks that run on `npm install`. Both hooks curl a hardcoded bare-IP endpoint over plain HTTP at 54.37.234.136, sending the installer's username (`whoami`), hostname, current working directory, and a timestamp as query-string parameters to `http://54.37.234.136/voicemail`. The same lifecycle scripts also embed an unbounded `for((i=1;;i++))` loop that repeatedly curls incrementing paths on the same host with a 10-second sleep, functioning as a long-poll channel to the attacker-controlled endpoint during install. The destination is a bare IP with no relationship to any package publisher domain, and the collected fields are host-identification data with no legitimate purpose in an install hook.
Malicious code in test22221 (npm)
Description
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (e4a3401759b5c6d7effdafcbae6027657e3cf8f9aabf1f04dfc2fa9039b64e53) package.json declares preinstall and postinstall lifecycle hooks that run on `npm install`. Both hooks curl a hardcoded bare-IP endpoint over plain HTTP at 54.37.234.136, sending the installer's username (`whoami`), hostname, current working directory, and a timestamp as query-string parameters to `http://54.37.234.136/voicemail`. The same lifecycle scripts also embed an unbounded `for((i=1;;i++))` loop that repeatedly curls incrementing paths on the same host with a 10-second sleep, functioning as a long-poll channel to the attacker-controlled endpoint during install. The destination is a bare IP with no relationship to any package publisher domain, and the collected fields are host-identification data with no legitimate purpose in an install hook.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-12478
- Osv Schema Version
- 1.7.4
- Aliases
- []
- Ecosystems
- ["npm"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a735741bf8831d539155e3a
Added to database: 08/05/2026, 15:31:13 UTC
Last updated: 08/05/2026, 15:31:13 UTC
Views: 1
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.