MAL-2026-12065

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/greatcall-customers-commandapi/MAL-2026-12065.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12065
Published
2026-08-05T01:44:04Z
Modified
2026-08-05T03:20:48.928987207Z
Summary
Malicious code in greatcall-customers-commandapi (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (a2e378b27f75da210578cf8a4102023d3cbf2ab7e96a97267d73c6ffa15500c9)

greatcall-customers-commandapi@99.0.0 is a dependency-confusion attack package. package.json self-describes as "Dependency confusion PoC" and declares preinstall, install, and postinstall lifecycle scripts all invoking node index.js. On any of the three install hooks, index.js collects host identifiers (os.hostname(), os.userInfo(), homedir, platform, cwd, network interfaces), captures the output of whoami and ls -la via childprocess.execSync, and enumerates process.env filtering for credential-shaped keys matching /KEY|SECRET|TOKEN|PASS|AUTH|CRED|PRIVATE|AWS|AZURE_|GCP_|GITHUB|NPM|DB_|DATABASE|API|WEBHOOK|JENKINS|OCTOPUS|CONNECTION/i, then POSTs the collected payload to a hardcoded webhook at https://test.v3n.my/pwn via https.request. The 99.0.0 version and internal-sounding name are the canonical dependency-confusion shape used to override a private registry package of the same name.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-08-05T03:11:16.891016486Z",
            "modified_time": "2026-08-05T01:44:04Z",
            "sha256": "a2e378b27f75da210578cf8a4102023d3cbf2ab7e96a97267d73c6ffa15500c9",
            "id": "IN-MAL-2026-011519",
            "versions": [
                "99.0.0"
            ],
            "source": "amazon-inspector"
        }
    ]
}
References
Credits

Affected packages

npm / greatcall-customers-commandapi

Package

Name
greatcall-customers-commandapi
View open source insights on deps.dev
Purl
pkg:npm/greatcall-customers-commandapi

Affected ranges

Affected versions

99.*
99.0.0

Database specific

cwes 
[
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    }
]
indicators 
{
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-qPy/sSKpuCWnd3Lv2oBio6jexqOQR4Af045opR1K6nfeaHekVG/BOaNTh283LsokKyffGufNVhB1OZHbwBtn3w==",
                "sha1": "b67ce92115370161d97ee76c5d3008ef3130b261"
            },
            "filename": "greatcall-customers-commandapi-99.0.0.tgz"
        }
    ],
    "evidence_files": [
        {
            "path": "index.js",
            "sha256": "f7bff4ab188e65ee22d349cecfcaa201b45d224444de4a8d141cfd8d17619331",
            "tlsh": "c52112f1a2e5a7b039b398d068436022a663c5173c16b8a0799c56541f8d5a881f15f9"
        },
        {
            "path": "package.json",
            "sha256": "8e1771e385b9d924e8e8054f55ffb43dfd20dfa86fbfc5223e598d7584214093",
            "tlsh": "c1e026309c30593328d42bd44c7b520415728e7b0444b8093ad7201cc6df22a45ff32d"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/greatcall-customers-commandapi/MAL-2026-12065.json"