{
  "affected": [
    {
      "database_specific": {
        "cwes": [
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          }
        ],
        "indicators": {
          "evidence_files": [
            {
              "path": "package.json",
              "sha256": "c9c9ab6cd10576fc108eb9b05e4e67c65a013eacb19b6673c5edc1ffc6910d4f",
              "tlsh": "81e0df239da25c7728f88ba69d2ac645f0624b3f10211d0f74ff801c4fb322255aef19"
            }
          ],
          "package_integrity": [
            {
              "filename": "c2-client-1.0.0.tgz",
              "hashes": {
                "sha1": "470818098d8ff778ccdd74bca1b07e8471006481",
                "sha512_sri": "sha512-lWnOqj3l6G+PSIcJXfOZOOwU1lXhtnemPF7MsRLFY0TYfh6BvszHFuXBxlJhaMwu0OWgOLwVL+Hm46xH2mGoPA=="
              }
            }
          ]
        }
      },
      "package": {
        "ecosystem": "npm",
        "name": "c2-client"
      },
      "versions": [
        "1.0.0"
      ]
    }
  ],
  "credits": [
    {
      "contact": [
        "inspector-research@amazon.com"
      ],
      "name": "Amazon Inspector",
      "type": "FINDER"
    }
  ],
  "database_specific": {
    "malicious-packages-origins": [
      {
        "id": "IN-MAL-2026-020513",
        "import_time": "2026-09-24T15:18:49.550234121Z",
        "modified_time": "2026-09-24T14:49:22Z",
        "sha256": "8c5e21fe48a0a1a03a1846e11cb06360950603c3bd8ccba5979c431c84779ba0",
        "source": "amazon-inspector",
        "versions": [
          "1.0.0"
        ]
      }
    ]
  },
  "details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (8c5e21fe48a0a1a03a1846e11cb06360950603c3bd8ccba5979c431c84779ba0)\nThe package name is \u0027c2-client\u0027 and package.json declares a postinstall hook that executes \u0027node setup.js\u0027 automatically on npm install. The setup script runs unattended in the installer\u0027s environment with the installer\u0027s privileges and network access. Combined with the package\u0027s self-declared C2-client purpose, install of this package is expected to establish an attacker-controlled command channel or execute attacker-controlled code on the installer\u0027s machine at install time.\n",
  "id": "MAL-2026-17165",
  "modified": "2026-09-24T14:49:22Z",
  "published": "2026-09-24T14:49:22Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/c2-client/v/1.0.0"
    }
  ],
  "schema_version": "1.7.4",
  "summary": "Malicious code in c2-client (npm)"
}