{"schema_version":"1.9.0","id":"MAL-2026-12435","published":"2026-08-05T13:07:29Z","modified":"2026-10-25T15:30:04.666557682Z","summary":"Malicious code in sc-geeksquad-core (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (2fd2458d8a5843f57187868a2c244a376dd3d2daef420d3c564c775ef6a2782a)\nsc-geeksquad-core@9999.0.0 declares a preinstall script `node callback.js` that runs automatically on `npm install`. The script collects the installer's hostname (`os.hostname()`), OS username (`os.userInfo().username`), current working directory (`process.cwd()`), configured npm registry (`npm_config_registry`), and a set of CI repository-slug environment variables (GITHUB_REPOSITORY, CI_PROJECT_PATH, BUILD_REPOSITORY_NAME, BITBUCKET_REPO_FULL_NAME, TRAVIS_REPO_SLUG, DRONE_REPO, BUILDKITE_PIPELINE_SLUG, CIRCLE_PROJECT_REPONAME, JOB_NAME), then sends them via HTTP GET to the hardcoded bare-IP endpoint `http://75.119.137.232:31337/depconfuse` as query parameters. The placeholder version `9999.0.0` combined with a generic scoped-sounding name is the canonical dependency-confusion reconnaissance shape: the package is published to public npm to intercept internal-package name resolution and beacon back which private-namespace builds are vulnerable to substitution.\n\n## Source: ossf-package-analysis (2094a7f35be1c723c65b36c32884f2f0e99840ef0bc090a1fbcb1f5568b93ef2)\nThe OpenSSF Package Analysis project identified 'sc-geeksquad-core' @ 99.9.1 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package communicates with a domain associated with malicious activity.\n","affected":[{"package":{"name":"sc-geeksquad-core","ecosystem":"npm","purl":"pkg:npm/sc-geeksquad-core"},"versions":["9999.0.0","99.9.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"callback.js","sha256":"34b0456abf5f832f3a75addcda3dc765fe77a0929196a9d4e754393fa0fe0af5","tlsh":"2b117bb9c68c0c3409c21780796c6c5eb8fbd29233c294917f2d71d26bb22b046b75b9"}],"package_integrity":[{"filename":"sc-geeksquad-core-9999.0.0.tgz","hashes":{"sha1":"2ba8e9b9308db1c083f88cf80285178f26e11490","sha512_sri":"sha512-upAoB93tviS4WRPiZVsgfejdOz9cBNsioQ2jEsYt3mWJaxmVOaxHCkxj7srGOJbYCiRBIDm1O7WxkJttGA/z/g=="}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/sc-geeksquad-core/MAL-2026-12435.json"}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/sc-geeksquad-core/v/9999.0.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/sc-geeksquad-core/v/99.9.1"}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-014891","import_time":"2026-08-05T13:08:53.322400325Z","modified_time":"2026-08-05T13:07:29Z","sha256":"2fd2458d8a5843f57187868a2c244a376dd3d2daef420d3c564c775ef6a2782a","source":"amazon-inspector","versions":["9999.0.0"]},{"import_time":"2026-10-19T06:40:14.928246478Z","modified_time":"2026-10-19T06:00:40Z","sha256":"2094a7f35be1c723c65b36c32884f2f0e99840ef0bc090a1fbcb1f5568b93ef2","source":"ossf-package-analysis","versions":["99.9.1"]},{"id":"IN-MAL-2026-021689","import_time":"2026-10-25T15:15:14.012165243Z","modified_time":"2026-10-25T15:05:13Z","sha256":"b2df703a9fb6d992eadbdfe74aa62892edaf4b494f9a2f6c5fa51f0f1b634376","source":"amazon-inspector","versions":["99.9.1"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"OpenSSF: Package Analysis","contact":["https://github.com/ossf/package-analysis","https://openssf.slack.com/channels/package_analysis"],"type":"FINDER"}]}