MAL-2026-12322

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@mgor/fw-canary-3333/MAL-2026-12322.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12322
Published
2026-08-05T12:49:33Z
Modified
2026-08-05T14:35:02.068399385Z
Summary
Malicious code in @mgor/fw-canary-3333 (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (6b82e18fdadfd37a1622c522a7ca4e9ae7772b266175123dfabb8d90e3950ef6)

On require of @mgor/fw-canary-3333, index.js executes a top-level shell command that curls https://fewafw.hydege.me and pipes the response into /bin/bash, running attacker-controlled shell content on the installer's host. The fetch is unpinned, unverified, and directed at a non-registry, non-publisher domain, so the executed bytes are whatever the remote host serves at request time. The package.json and README present the package as an inert canary with 'no functionality, no dependencies, and no install scripts', a cover story that directly contradicts the fetch-and-exec side effect in index.js.

Database specific 
{
    "malicious-packages-origins": [
        {
            "source": "amazon-inspector",
            "modified_time": "2026-08-05T12:49:33Z",
            "sha256": "6b82e18fdadfd37a1622c522a7ca4e9ae7772b266175123dfabb8d90e3950ef6",
            "id": "IN-MAL-2026-014776",
            "versions": [
                "0.0.1"
            ],
            "import_time": "2026-08-05T13:08:45.569791028Z"
        },
        {
            "source": "amazon-inspector",
            "modified_time": "2026-08-05T13:18:51Z",
            "sha256": "df28c27ff75e5913ab87d5599cd30b519560218affa0189859ee734b7e3ef0d0",
            "id": "IN-MAL-2026-014969",
            "versions": [
                "0.0.2"
            ],
            "import_time": "2026-08-05T14:19:47.899984775Z"
        }
    ]
}
References
Credits

Affected packages

npm / @mgor/fw-canary-3333

Package

Name
@mgor/fw-canary-3333
View open source insights on deps.dev
Purl
pkg:npm/%40mgor/fw-canary-3333

Affected ranges

Affected versions

0.*
0.0.1
0.0.2

Database specific

cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    },
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]
indicators 
{
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-3es9cnPCxDA0BhWm9OixPNflhHvh5nZLRbMTNjw9DzZaNaPKKggdq+HbWRwZ8rgn1jgr9QuuzWrPzr3Miu3dOw==",
                "sha1": "97b69f0e9cff7fca1e7c0d35688d01a1d6d63d7b"
            },
            "filename": "fw-canary-3333-0.0.1.tgz"
        }
    ],
    "evidence_files": [
        {
            "path": "index.js",
            "sha256": "43b5cbde57b8e21fd2b3e8b1c105c20113a81817f29fcdfe94d02c5e7cfc2710",
            "tlsh": "64f0c0041cf2627382a954b16a579d47238bf541123dd8bae897036857c5b008f433f6"
        },
        {
            "path": "README.md",
            "sha256": "bb8648f4e3914bfc87732a9e42f116d5c1d816163502e011d5f70ac69a32beee",
            "tlsh": "e9e0dc0a16c0336216816fa335089324cb61b0b4607444682ccf40dcf495a441b27afa"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@mgor/fw-canary-3333/MAL-2026-12322.json"