{"id":"MAL-2026-18288","revision":"6acfe9d7e202481491b0b0786bb092ae","records":[{"revision":"6acfe9d7e202481491b0b0786bb092ae","observedAt":"2026-10-25T16:17:16.268+00:00","statement":{"source":"osv","id":"MAL-2026-18288","aliases":[],"title":"Malicious code in jshelperdependenceny (npm)","description":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (dc4d19697f4104351bb25b7e568018ec6ed85d626b7265fb4b9682ae12183be9)\nnpm package 'jshelperdependenceny' is published at version 99.0.0 with a preinstall banner stating it is intended to shadow an internal v1.0.0 package of the same name — the classic dependency-confusion shape of using an inflated version to win resolution against a private registry. On install, package.json runs 'node preinstall.js || true', which collects os.hostname(), os.platform(), os.arch(), and the package name/version and POSTs them as JSON to a URL taken from the DC_CALLBACK_URL environment variable, defaulting to http://127.0.0.1:5656/exfil. The env-var override turns the loopback default into a functional attacker-configurable beacon that fires automatically on npm install and discloses installer host identifiers plus confirmation that the shadowed internal name resolved to this public artifact.\n","state":0,"publishedAt":"2026-10-25T15:11:25+00:00","modifiedAt":"2026-10-25T15:30:04.5340654+00:00","affected":[{"ecosystem":"npm","name":"jshelperdependenceny","ranges":[],"versions":["99.0.0"],"rawVersionEvidence":null}],"metrics":[],"references":["https://www.npmjs.com/package/jshelperdependenceny/v/99.0.0"],"sourceUrl":"https://osv.dev/vulnerability/MAL-2026-18288","license":"OSV · upstream source license applies","key":"osv:MAL-2026-18288","identifiers":["MAL-2026-18288"]},"retained":false,"historicalAffected":[]}],"coverage":[]}