MAL-2026-12032

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/add-two-numbers-x7q9m/MAL-2026-12032.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12032
Published
2026-08-05T01:00:50Z
Modified
2026-08-05T14:35:11.572162522Z
Summary
Malicious code in add-two-numbers-x7q9m (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (550dfc48a74577d95e53fc64cc296a9cc59a5940edb6eac3f191f41376350635)

The package advertises itself as a trivial 'add two numbers' utility but its preinstall lifecycle script enumerates the installer's Desktop directory, reads.txt files, applies a regex (/npm_[A-Za-z0-9_-]+/) to extract npm authentication tokens, and transmits any match as a query parameter to the hardcoded endpoint https://lively-bird-15.webhook.cool. This runs automatically on npm install. The behavior has no relation to the package's advertised arithmetic functionality, and the random name suffix is consistent with a disposable malicious-publish account. Harvested npm tokens enable registry account takeover and downstream supply-chain propagation via the victim's publish rights.

Database specific 
{
    "malicious-packages-origins": [
        {
            "versions": [
                "1.0.0"
            ],
            "sha256": "550dfc48a74577d95e53fc64cc296a9cc59a5940edb6eac3f191f41376350635",
            "import_time": "2026-08-05T01:39:30.817175254Z",
            "id": "IN-MAL-2026-011479",
            "modified_time": "2026-08-05T01:00:50Z",
            "source": "amazon-inspector"
        },
        {
            "versions": [
                "1.0.1"
            ],
            "import_time": "2026-08-05T14:19:43.232813305Z",
            "sha256": "2ec8df5e22704e01dbe83cb2b85e111a1d796cf84f04caa4c56c536678795cd4",
            "id": "IN-MAL-2026-014922",
            "modified_time": "2026-08-05T13:12:06Z",
            "source": "amazon-inspector"
        }
    ]
}
References
Credits

Affected packages

npm / add-two-numbers-x7q9m

Package

Name
add-two-numbers-x7q9m
View open source insights on deps.dev
Purl
pkg:npm/add-two-numbers-x7q9m

Affected ranges

Affected versions

1.*
1.0.0
1.0.1

Database specific

indicators 
{
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-1Inft9bgCUfN6bBUuap1+WzTwDP4afyNU7yZ7MlblQmM7XwymZ+kTaFIGg+zVuI8odgTI8jd0E1aCjlFHk7kGQ==",
                "sha1": "23226ba1e2b5fd74458201b17ae943d29cd318c9"
            },
            "filename": "add-two-numbers-x7q9m-1.0.0.tgz"
        }
    ],
    "evidence_files": [
        {
            "path": "scripts/preinstall.js",
            "sha256": "1e2b721d5a878cf9c11fea78812f8655b88c0125d10afcb9b413d7e21a410643",
            "tlsh": "2a110ee5cde82134b77160d48e072c1f759fce623e82c981c25c19a623d4d484a9aebe"
        },
        {
            "tlsh": "96f08220cc115e6324c45b925d76564665a24a2b45187c1837c3503c8f9f36f24ff55e",
            "sha256": "fe63e3808f096865c61e424761b12f66f3c9649e7b4a6d6879b3df77131740c8",
            "path": "package.json"
        }
    ]
}
cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/add-two-numbers-x7q9m/MAL-2026-12032.json"