Malicious code in test1df23 (npm)
Historical advisory saved 24 Oct 2026 13:17:17 UTC. The publisher may have updated it since then. Latest advisory.
osv · MAL-2026-16312
Published--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (67708642854d76da722a8130de47a8fb7fd23f0035cf646f1bf16d97419e5756) package.json declares preinstall and postinstall hooks that execute index.js on npm install. index.js issues an HTTP GET to the hardcoded bare IP 128.199.122.145 over plain HTTP, with the package name embedded in the query string (http://128.199.122.145/?test1df23). The beacon fires automatically at install time, leaking the installer's outbound IP and confirming successful execution on the installer's host to the operator of that IP. The package name and near-empty payload are consistent with a dependency-confusion or typosquat probe.
- Source published
- 21 Sep 2026 03:23:16 UTC
- Source modified
- 21 Sep 2026 03:30:16 UTC
- Saved here
- 24 Oct 2026 13:17:17 UTC
- Source terms
- OSV · upstream source license applies
Original source record · Cite this exact observation · Complete original publisher JSON
Source: osv · OSV · upstream source license applies. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.