{
  "affected": [
    {
      "database_specific": {
        "cwes": [
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          }
        ],
        "indicators": {
          "evidence_files": [
            {
              "path": "dc.js",
              "sha256": "db09ea3714030d84eee4eb3d0f5f9ec1b3fcbcabc952726bac728ef03b5c3dad",
              "tlsh": "1021945b2166f42205b370d0375f220c61fae1228e82ea993428e2d4af346781252cfd"
            },
            {
              "path": "package.json",
              "sha256": "e5bc7e2ed956a118b24c8b6b0917c7dfccca953ea7e58962bd5427fe0b43fcd6",
              "tlsh": "22e07d444920523308d55ee94473514de1b10d5f110da905178351888298ff748b934f"
            }
          ],
          "package_integrity": [
            {
              "filename": "lumen-pages-community-9.9.9.tgz",
              "hashes": {
                "sha1": "93abca10f1876e86c6cd933b30f5b8ca9197dc8d",
                "sha512_sri": "sha512-kwA81Fg9Mv16OmkW5UT/TzxIfLzyGP5Er2ekuTkqGqPGqBs6WHaoLRlxrGPHsvTfLOAbdsmFwF2SnGLiKEecIg=="
              }
            }
          ]
        }
      },
      "package": {
        "ecosystem": "npm",
        "name": "lumen-pages-community"
      },
      "versions": [
        "9.9.9"
      ]
    }
  ],
  "credits": [
    {
      "contact": [
        "inspector-research@amazon.com"
      ],
      "name": "Amazon Inspector",
      "type": "FINDER"
    }
  ],
  "database_specific": {
    "malicious-packages-origins": [
      {
        "id": "IN-MAL-2026-018512",
        "import_time": "2026-08-21T22:42:49.933927379Z",
        "modified_time": "2026-08-21T22:11:02Z",
        "sha256": "b7c1d6b7b99791f7bbd5999021f109bef569a6c681eda0bb6196b459b12a3808",
        "source": "amazon-inspector",
        "versions": [
          "9.9.9"
        ]
      }
    ]
  },
  "details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (b7c1d6b7b99791f7bbd5999021f109bef569a6c681eda0bb6196b459b12a3808)\nlumen-pages-community@9.9.9 declares a postinstall hook (`node dc.js`) that runs automatically on `npm install`. dc.js collects the installer\u0027s hostname, username, current working directory, platform, Node version, CI environment variable, and npm user-agent, then issues an HTTPS GET to a hardcoded webhook.site collector URL (https://webhook.site/b00492c6-27ba-4ea0-a9cb-dd50b3770250/dc) with those fields as query parameters. The package name plus a 9.9.9 version and no library functionality matches the dependency-confusion shape: a high-version public namesake that catches internal-name resolution and phones home from any host that resolves it. A self-labeled \u0027research placeholder\u0027 framing in the package description does not change the runtime behavior \u2014 installer identifiers leave the host at install time to a third-party collector the installer did not opt into.\n",
  "id": "MAL-2026-14356",
  "modified": "2026-08-21T22:11:02Z",
  "published": "2026-08-21T22:11:02Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/lumen-pages-community/v/9.9.9"
    }
  ],
  "schema_version": "1.7.4",
  "summary": "Malicious code in lumen-pages-community (npm)"
}