MAL-2026-12804

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/store-locator-widget/MAL-2026-12804.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12804
Published
2026-08-05T13:10:37Z
Modified
2026-08-05T14:37:21.804266942Z
Summary
Malicious code in store-locator-widget (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (1b2ffc9f3972c8313fe78eaac2412cc8e46a693d149404736a089a18596ff7f5)

store-locator-widget@9999.0.0 ships an empty library body (index.js exports {}) and a preinstall hook (node callback.js) that, on npm install, collects the installer's hostname, username, current working directory, configured npm registry, and CI project-slug environment variables (GITHUBREPOSITORY, CIPROJECTPATH, BUILDREPOSITORY_NAME, and similar) and transmits them as query-string parameters via HTTP GET to a hardcoded bare-IP endpoint at http://75.119.137.232:31337/depconfuse. The version number 9999.0.0, the placeholder description, the empty module body, and the /depconfuse URL path together match the dependency-confusion reconnaissance probe pattern: the package delivers no advertised functionality and its sole install-time effect is to leak information about the installer's internal package namespace and build environment to an attacker-controlled destination.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-014913",
            "import_time": "2026-08-05T14:19:42.426884441Z",
            "sha256": "1b2ffc9f3972c8313fe78eaac2412cc8e46a693d149404736a089a18596ff7f5",
            "modified_time": "2026-08-05T13:10:37Z",
            "versions": [
                "9999.0.0"
            ],
            "source": "amazon-inspector"
        }
    ]
}
References
Credits

Affected packages

npm / store-locator-widget

Package

Name
store-locator-widget
View open source insights on deps.dev
Purl
pkg:npm/store-locator-widget

Affected ranges

Affected versions

9999.*
9999.0.0

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-bxrJvhQlsN8l1mMTuybmQT/q/d+aXzjWr5YvDId5SPV0QIygEoxiMtreEgqbyPrnwUe947nIr9HrC80jphPMww==",
                "sha1": "3e5f0b997380487aa9ef71695e5795d219b530b4"
            },
            "filename": "store-locator-widget-9999.0.0.tgz"
        }
    ],
    "evidence_files": [
        {
            "sha256": "fd072754fe395d3754541d4cad41f6dcc852d2bfc7bc166359c6c85561fc75fb",
            "path": "callback.js",
            "tlsh": "97117bb9c68c0c3409c21784b9696c1eb8fbd29133c294917f2d71d26bb22b446b75b9"
        },
        {
            "sha256": "990a2ecd70093a1926f9ae43290c9521020587e2eb9dc818574dc0d5dbe38aa3",
            "path": "package.json",
            "tlsh": "50d02b30aa1248332cc4ebd24c17054211628e1b010438192b47501d05a826b15bf24d"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/store-locator-widget/MAL-2026-12804.json"