{"id":"MAL-2026-16541","revision":"f0fcc778f0da486a93fb2ec2dbd5c5c1","records":[{"revision":"f0fcc778f0da486a93fb2ec2dbd5c5c1","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"MAL-2026-16541","aliases":[],"title":"Malicious code in zeal-util-hooks (npm)","description":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (2c9ed95500d2f1c637bcf47151a9220c0a81ee6cbd7a7aa4a8f66c74fed6e341)\npostinstall.js and index.js load canary.js, which POSTs a JSON payload to https://npm-canary.aveliscare.com/beacon at install time and on require. The payload contains os.hostname(), os.userInfo() username, cwd, process.platform, node version, npm user agent, parent package name/version, and a fixed allowlist of CI-identifier env vars (GITHUB_REPOSITORY, GITHUB_ACTOR, GITHUB_REF, GITHUB_RUN_ID, EAS/VERCEL/BUILDKITE identifiers). The endpoint is overridable via ZEAL_CANARY_URL but defaults to the hardcoded aveliscare.com host. The package advertises publisher Zeal (getzeal.io, github.com/zeal-io); the beacon destination aveliscare.com does not match that publisher. The collected fields are host/CI identifiers rather than credentials or filesystem contents, and no code execution, credential read, or persistent artifact is present. The install-time/require-time outbound network without opt-out breaks air-gapped installs, and the publisher/destination-domain mismatch is the shape typical of a dependency-confusion canary used to log where a placeholder name resolves.\n","state":0,"publishedAt":"2026-09-22T17:46:48+00:00","modifiedAt":"2026-09-30T01:00:06.9443606+00:00","affected":[{"ecosystem":"npm","name":"zeal-util-hooks","ranges":[],"versions":["0.0.0"],"rawVersionEvidence":null}],"metrics":[],"references":["https://www.npmjs.com/package/zeal-util-hooks/v/0.0.0"],"sourceUrl":"https://osv.dev/vulnerability/MAL-2026-16541","license":"OSV · upstream source license applies","key":"osv:MAL-2026-16541","identifiers":["MAL-2026-16541"]},"retained":false,"historicalAffected":[]}],"coverage":[]}