{"id":"MAL-2026-12435","revision":"81e3e7fa551a42299d40ac68e33a998b","records":[{"revision":"81e3e7fa551a42299d40ac68e33a998b","observedAt":"2026-10-25T16:17:16.268+00:00","statement":{"source":"osv","id":"MAL-2026-12435","aliases":[],"title":"Malicious code in sc-geeksquad-core (npm)","description":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (2fd2458d8a5843f57187868a2c244a376dd3d2daef420d3c564c775ef6a2782a)\nsc-geeksquad-core@9999.0.0 declares a preinstall script `node callback.js` that runs automatically on `npm install`. The script collects the installer's hostname (`os.hostname()`), OS username (`os.userInfo().username`), current working directory (`process.cwd()`), configured npm registry (`npm_config_registry`), and a set of CI repository-slug environment variables (GITHUB_REPOSITORY, CI_PROJECT_PATH, BUILD_REPOSITORY_NAME, BITBUCKET_REPO_FULL_NAME, TRAVIS_REPO_SLUG, DRONE_REPO, BUILDKITE_PIPELINE_SLUG, CIRCLE_PROJECT_REPONAME, JOB_NAME), then sends them via HTTP GET to the hardcoded bare-IP endpoint `http://75.119.137.232:31337/depconfuse` as query parameters. The placeholder version `9999.0.0` combined with a generic scoped-sounding name is the canonical dependency-confusion reconnaissance shape: the package is published to public npm to intercept internal-package name resolution and beacon back which private-namespace builds are vulnerable to substitution.\n\n## Source: ossf-package-analysis (2094a7f35be1c723c65b36c32884f2f0e99840ef0bc090a1fbcb1f5568b93ef2)\nThe OpenSSF Package Analysis project identified 'sc-geeksquad-core' @ 99.9.1 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package communicates with a domain associated with malicious activity.\n","state":0,"publishedAt":"2026-08-05T13:07:29+00:00","modifiedAt":"2026-10-25T15:30:04.6665577+00:00","affected":[{"ecosystem":"npm","name":"sc-geeksquad-core","ranges":[],"versions":["9999.0.0","99.9.1"],"rawVersionEvidence":null}],"metrics":[],"references":["https://www.npmjs.com/package/sc-geeksquad-core/v/9999.0.0","https://www.npmjs.com/package/sc-geeksquad-core/v/99.9.1"],"sourceUrl":"https://osv.dev/vulnerability/MAL-2026-12435","license":"OSV · upstream source license applies","key":"osv:MAL-2026-12435","identifiers":["MAL-2026-12435"]},"retained":false,"historicalAffected":[]}],"coverage":[]}