MAL-2026-10493

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/insomnia-plugin-poc-m4gester-run/MAL-2026-10493.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-10493
Published
2026-07-13T21:04:34Z
Modified
2026-07-13T21:31:55.100156693Z
Summary
Malicious code in insomnia-plugin-poc-m4gester-run (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (38a525aea57681df6c21035b723701fa6067f091fd81ac26bb3fcc8e2126c43e)

package.json declares a postinstall lifecycle hook that runs calc.exe on the installer's machine during npm install. The main entry point exports only an empty requestHooks array, providing no actual Insomnia plugin functionality — the package's sole effect is the arbitrary command execution at install time. The name self-identifies as a proof-of-concept and mimics the Insomnia plugin naming convention with a leet-substituted variant, indicating the package exists solely to demonstrate/exploit install-time RCE. While calc.exe itself is benign, the postinstall hook establishes full arbitrary-command-execution capability against any developer installing the package on Windows.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-010318",
            "sha256": "38a525aea57681df6c21035b723701fa6067f091fd81ac26bb3fcc8e2126c43e",
            "modified_time": "2026-07-13T21:04:34Z",
            "import_time": "2026-07-13T21:25:58.795095532Z",
            "versions": [
                "1.0.0"
            ],
            "source": "amazon-inspector"
        }
    ]
}
References
Credits

Affected packages

npm / insomnia-plugin-poc-m4gester-run

Package

Name
insomnia-plugin-poc-m4gester-run
View open source insights on deps.dev
Purl
pkg:npm/insomnia-plugin-poc-m4gester-run

Affected ranges

Affected versions

1.*
1.0.0

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/insomnia-plugin-poc-m4gester-run/MAL-2026-10493.json"
cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "sha256": "c2976db0b91be3b957e378fc7ba55588b8d13e125be54be40dc7d64b2f73fbc7",
            "tlsh": "dfc08030d551653314c406c541b556435d414d170104540403d32060f6efb72189e70f",
            "path": "package.json"
        }
    ],
    "package_integrity": [
        {
            "filename": "insomnia-plugin-poc-m4gester-run-1.0.0.tgz",
            "hashes": {
                "sha1": "2ef397f337cd1c7d809e8ee1d8d841c900d45a30",
                "sha512_sri": "sha512-2eQhPgFHXBRGQK+TX0S7Ashf2oo6kPMxI2cl+YYWs829L5twFlLMCxDSqCCLuSEhxec1VKooW8Ky2BEAMV+Kaw=="
            }
        }
    ]
}