{
  "affected": [
    {
      "database_specific": {
        "cwes": [
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          },
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          }
        ],
        "indicators": {
          "evidence_files": [
            {
              "path": "index.js",
              "sha256": "9f166ed0f6ddc8c6af3cdecd03dc086fa3921102a3c569d92326718e028f7103",
              "tlsh": "33411399a2d917330de114c06a0c70852359fa777159a8d076cf4396af869f8b7226f3"
            },
            {
              "path": "package.json",
              "sha256": "57f305d98ee36961808b9408ddb98d5d0b15ea1b77e09564860d2b843f8060f9",
              "tlsh": "4fd0a7384d21553325c516a20c2b944772618f2f04043c0863cb182c91ce77798ff35c"
            }
          ],
          "package_integrity": [
            {
              "filename": "with-cte-1.0.0.tgz",
              "hashes": {
                "sha1": "c182f210794123466d1568c3d909160e0f34e52e",
                "sha512_sri": "sha512-Hbkil57Pefuv1lLN9G2JJyU7M1x65dbCqf/uLxDGND4Y+3Ky4m3nZKq61ZInD7Dd+ZMG8cgI2TsOgbtMhFnDpQ=="
              }
            }
          ]
        }
      },
      "package": {
        "ecosystem": "npm",
        "name": "with-cte"
      },
      "versions": [
        "1.0.0"
      ]
    }
  ],
  "credits": [
    {
      "contact": [
        "inspector-research@amazon.com"
      ],
      "name": "Amazon Inspector",
      "type": "FINDER"
    },
    {
      "contact": [
        "https://www.invisirisk.com",
        "mailto:research@invisirisk.com"
      ],
      "name": "InvisiRisk, Inc.",
      "type": "FINDER"
    }
  ],
  "database_specific": {
    "iocs": {
      "domains": [
        "187d714jo62z5j5c39hc437myd44sxgm.oastify.com"
      ],
      "files": [
        {
          "digests": {
            "sha256": "57f305d98ee36961808b9408ddb98d5d0b15ea1b77e09564860d2b843f8060f9"
          },
          "note": "preinstall script runs `node index.js`.",
          "paths": [
            "package.json"
          ],
          "source": "PACKAGE_ARCHIVE"
        },
        {
          "digests": {
            "sha256": "9f166ed0f6ddc8c6af3cdecd03dc086fa3921102a3c569d92326718e028f7103"
          },
          "note": "Executed by the preinstall script of with-cte@1.0.0.",
          "paths": [
            "index.js"
          ],
          "source": "PACKAGE_ARCHIVE"
        }
      ],
      "urls": [
        "https://187d714jo62z5j5c39hc437myd44sxgm.oastify.com/"
      ]
    },
    "malicious-packages-origins": [
      {
        "id": "IN-MAL-2026-021080",
        "import_time": "2026-10-05T16:22:57.062637671Z",
        "modified_time": "2026-10-05T16:14:55Z",
        "sha256": "8eceeb0a05cd8d1a289f1a1006df8acd825d73f341ec1a50e095dc2850b866c8",
        "source": "amazon-inspector",
        "versions": [
          "1.0.0"
        ]
      }
    ]
  },
  "details": "with-cte@1.0.0 contains no functional code: its only behaviour is a preinstall script that runs `node index.js` on npm install. index.js collects the install directory, the user\u0027s home directory, hostname, username and DNS servers, and the full contents of /etc/passwd and /etc/hosts, then sends them as JSON in an HTTPS POST to `187d714jo62z5j5c39hc437myd44sxgm.oastify.com`, a Burp Collaborator endpoint. The npm account testneo7755 published it on 2026-10-05 and it was unpublished 56 seconds later; the same account published checkmate-remediation-assistant the same day with the same index.js and a different Collaborator subdomain.\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (8eceeb0a05cd8d1a289f1a1006df8acd825d73f341ec1a50e095dc2850b866c8)\nThe package declares a preinstall lifecycle hook (`preinstall: node index.js`) that runs automatically on `npm install`. index.js collects installer host identifiers (os.hostname, os.userInfo, homedir, DNS servers) and reads the contents of /etc/passwd and /etc/hosts, then POSTs the collected data over HTTPS to the Burp Collaborator subdomain 187d714jo62z5j5c39hc437myd44sxgm.oastify.com. The package otherwise contains no library code, has empty author/description metadata, and provides no functionality \u2014 the shipped surface is solely the install-time beacon, consistent with a dependency-confusion or internal-name squat probe.\n",
  "id": "MAL-2026-17579",
  "modified": "2026-10-07T06:20:58.385236514Z",
  "published": "2026-10-05T08:04:30Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/with-cte/v/1.0.0"
    },
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/with-cte"
    }
  ],
  "schema_version": "1.7.4",
  "summary": "Malicious code in with-cte (npm)"
}