Vulnerability-Lookup

MAL-2026-17214

Vulnerability from ossf_malicious_packages

Published

2026-09-28 14:18

Modified

2026-09-28 14:18

Summary

Malicious code in git-en-boite-logging (npm)

Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (f6ebee9f4428d7f14f6f941438064715c8bece34c5fe6bfedf32bbd8cba226c0)

package.json declares a preinstall lifecycle hook that runs wget to a hardcoded webhook.site collector URL (https://webhook.site/3fcfa5af-1b4e-4556-9d48-26190d02795f/), passing $(whoami), $(hostname), and $(pwd) as query parameters. On npm install, npm invokes the preinstall script automatically, so the installer's OS username, host name, and current working directory are transmitted to an anonymous third-party webhook collector without any user action. This is the canonical dependency-confusion / reconnaissance beacon shape: an otherwise-empty package whose only on-install effect is to phone home installer identity to an attacker-chosen endpoint, typically used to confirm ingress into a target's internal build environment before staging a follow-on payload.

CWE

CWE-506 - The product contains code that appears to be malicious in nature.

Credits

Amazon Inspector inspector-research@amazon.com

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "cwes": [
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          }
        ],
        "indicators": {
          "evidence_files": [
            {
              "path": "package.json",
              "sha256": "eeeb7167a98450e8be74ff678e8b1e72ba1c68ed75fd157f1352d5e90dfdfe30",
              "tlsh": "5f01d334f620b92307c597a15525461bba32fba7da1a6c0deba71259531d8ea0078a18"
            }
          ],
          "package_integrity": [
            {
              "filename": "git-en-boite-logging-0.0.0.tgz",
              "hashes": {
                "sha1": "9b6320e561bb6b58d363bface8b6c6f90fea6c28",
                "sha512_sri": "sha512-NpfFTMEfKE1HF+2F7ZE66DoiQj017DTFOa4a1glV0xG0lthw4cwFH6PnFVjERMxGYlnyeUHVEk8q+VxobgInkQ=="
              }
            }
          ]
        }
      },
      "package": {
        "ecosystem": "npm",
        "name": "git-en-boite-logging"
      },
      "versions": [
        "0.0.0"
      ]
    }
  ],
  "credits": [
    {
      "contact": [
        "inspector-research@amazon.com"
      ],
      "name": "Amazon Inspector",
      "type": "FINDER"
    }
  ],
  "database_specific": {
    "malicious-packages-origins": [
      {
        "id": "IN-MAL-2026-020579",
        "import_time": "2026-09-28T14:21:43.654845338Z",
        "modified_time": "2026-09-28T14:18:12Z",
        "sha256": "f6ebee9f4428d7f14f6f941438064715c8bece34c5fe6bfedf32bbd8cba226c0",
        "source": "amazon-inspector",
        "versions": [
          "0.0.0"
        ]
      }
    ]
  },
  "details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (f6ebee9f4428d7f14f6f941438064715c8bece34c5fe6bfedf32bbd8cba226c0)\npackage.json declares a preinstall lifecycle hook that runs `wget` to a hardcoded webhook.site collector URL (https://webhook.site/3fcfa5af-1b4e-4556-9d48-26190d02795f/), passing `$(whoami)`, `$(hostname)`, and `$(pwd)` as query parameters. On `npm install`, npm invokes the preinstall script automatically, so the installer\u0027s OS username, host name, and current working directory are transmitted to an anonymous third-party webhook collector without any user action. This is the canonical dependency-confusion / reconnaissance beacon shape: an otherwise-empty package whose only on-install effect is to phone home installer identity to an attacker-chosen endpoint, typically used to confirm ingress into a target\u0027s internal build environment before staging a follow-on payload.\n",
  "id": "MAL-2026-17214",
  "modified": "2026-09-28T14:18:12Z",
  "published": "2026-09-28T14:18:12Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/git-en-boite-logging/v/0.0.0"
    }
  ],
  "schema_version": "1.7.4",
  "summary": "Malicious code in git-en-boite-logging (npm)"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted