MAL-2024-2355

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/faceplate-docs/MAL-2024-2355.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2024-2355
Published
2024-06-25T12:42:27Z
Modified
2026-09-23T02:00:07Z
Summary
Malicious code in faceplate-docs (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (f5198954164869432a0fda9f3f723c1db53531ab2f73db84523e6f62946cf420)

faceplate-docs@99.9.10 runs index.js from a postinstall hook that collects the installer's OS username, current working directory, hostname, and local IPv4 address and POSTs them as JSON to a hardcoded anonymous collector at https://webhook.site/f9bff304-3053-4d54-be05-86537267514a. The beacon fires automatically on npm install without any user interaction. The package name plus implausibly high version (99.9.10) and the recon-only payload are characteristic of a dependency-confusion probe designed to identify internal build environments that mistakenly resolve a private package name from the public registry.

Database specific 
{
    "malicious-packages-origins":  [
        {
            "id":  "RLMA-2024-00999",
            "import_time":  "2024-06-28T02:43:13.468838694Z",
            "modified_time":  "2024-06-25T12:42:27Z",
            "sha256":  "62fca832a92eea3afa7f618b4dc1d7836667d7dfebc1bdf74101b3089cd6b4c6",
            "source":  "reversing-labs",
            "versions":  [
                "1.0.0"
            ]
        },
        {
            "id":  "RLUA-2024-06564",
            "import_time":  "2024-10-24T00:57:49.579466852Z",
            "modified_time":  "2024-10-16T12:52:21Z",
            "sha256":  "affa8e86727aac03b3de13a058923786285a642dea2a4caf7e4fbc6f5f3cc5f3",
            "source":  "reversing-labs"
        },
        {
            "id":  "IN-MAL-2026-020325",
            "import_time":  "2026-09-23T01:50:19.031755512Z",
            "modified_time":  "2026-09-23T01:37:05Z",
            "sha256":  "6f62abf7b41e2c3fc246dbe3a35af15b8ef48e4ce1547e57ba3053668a82e8bd",
            "source":  "amazon-inspector",
            "versions":  [
                "99.9.9"
            ]
        },
        {
            "id":  "IN-MAL-2026-020324",
            "import_time":  "2026-09-23T01:50:18.952508207Z",
            "modified_time":  "2026-09-23T01:36:53Z",
            "sha256":  "f5198954164869432a0fda9f3f723c1db53531ab2f73db84523e6f62946cf420",
            "source":  "amazon-inspector",
            "versions":  [
                "99.9.10"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / faceplate-docs

Package

Name
faceplate-docs
View open source insights on deps.dev
Purl
pkg:npm/faceplate-docs

Affected ranges

Affected versions

1.*
1.0.0
99.*
99.9.9
99.9.10

Database specific

cwes 
[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files":  [
        {
            "path":  "index.js",
            "sha256":  "43c080ba45f522e0416a363fa622657b37a439a960eedebdbf5b2c56878f7204",
            "tlsh":  "b311c2e68cab10140e7177b14c034805f7225732751a9781bdbcc1dd6fa69a5a271eec"
        }
    ],
    "package_integrity":  [
        {
            "filename":  "faceplate-docs-99.9.9.tgz",
            "hashes":  {
                "sha1":  "d4084e5623cee7f750f749ead53480500f1220ee",
                "sha512_sri":  "sha512-uFZgEqT0vlIoEnuaPBfqSq+3hdGW169peONpxTMf1/GZy7AdN4QpcrzbvRF2fymE1RHeS1iOojHu/OA0K2J6jg=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/faceplate-docs/MAL-2024-2355.json"