MAL-2026-13458

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/squeez/MAL-2026-13458.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13458
Published
2026-08-06T19:46:25Z
Modified
2026-08-06T23:50:21.089016055Z
Summary
Malicious code in squeez (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (a953148095c35441147f1622c4810e0b946e5d120a74cfbe14f1771276a731d7)

squeez@1.38.0 declares a postinstall hook ("postinstall": "node install.js") that runs automatically on npm install. install.js imports childprocess, fs, https, and os; branches on process.platform; reads os.homedir(); performs fs.existsSync/readFileSync checks against paths under the user's home directory; and issues https.get requests to raw.githubusercontent.com URLs. The combination of an install-time lifecycle script, filesystem reads of home-directory paths, process spawning capability, and fetching content from a mutable third-party host at install time constitutes an install-time remote-content-fetch-and-execute pattern with home-directory reconnaissance. Fetching executable content from raw.githubusercontent.com at install time is a mutable, unpinned delivery channel: the current content of those URLs can change at any time without a package release, and the fetched bytes are handled inside a script that also has childprocess available.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-016815",
            "import_time": "2026-08-06T23:25:10.760161255Z",
            "sha256": "0b13d20d19ea0a8d54c03338cee13994ca570c587fb809a035fd7cf3f72e27cc",
            "modified_time": "2026-08-06T19:46:35Z",
            "source": "amazon-inspector",
            "versions": [
                "1.40.0"
            ]
        },
        {
            "id": "IN-MAL-2026-016814",
            "import_time": "2026-08-06T23:25:10.683637165Z",
            "sha256": "4991cb893b5cb093cad80227f428e2161aa36cdfd918aa12009818199b88ecf5",
            "modified_time": "2026-08-06T19:46:25Z",
            "source": "amazon-inspector",
            "versions": [
                "1.44.1"
            ]
        },
        {
            "id": "IN-MAL-2026-016817",
            "import_time": "2026-08-06T23:25:10.816694675Z",
            "sha256": "779daf2d38cd96af82b4dc2dd8f29d362dc5e5c0db1340134a8de2e5c8ce21c9",
            "versions": [
                "1.42.1"
            ],
            "source": "amazon-inspector",
            "modified_time": "2026-08-06T19:46:54Z"
        },
        {
            "id": "IN-MAL-2026-016816",
            "import_time": "2026-08-06T23:25:10.786740917Z",
            "sha256": "a953148095c35441147f1622c4810e0b946e5d120a74cfbe14f1771276a731d7",
            "versions": [
                "1.38.0"
            ],
            "source": "amazon-inspector",
            "modified_time": "2026-08-06T19:46:44Z"
        }
    ]
}
References
Credits

Affected packages

npm / squeez

Package

Name
squeez
View open source insights on deps.dev
Purl
pkg:npm/squeez

Affected ranges

Affected versions

1.*
1.38.0
1.40.0
1.42.1
1.44.1

Database specific

cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/squeez/MAL-2026-13458.json"
indicators 
{
    "evidence_files": [
        {
            "path": "install.js",
            "tlsh": "20e153fa44f752387db2e17cd60b215a1537a1133226ea70717df240afcc1a845a6afa",
            "sha256": "f13107285ab0d05bbaab4f56b51e042e6078e3a8313393e34196ebc99923634f"
        },
        {
            "path": "package.json",
            "tlsh": "0d114864c4742eb32ad87b94c99a2059a2350947a9603c2a736fc31c5b8c1ab25bf57d",
            "sha256": "e9534be7395668d5326f48780a444a774279bf30ef51481ac1e4f2a6cf846569"
        }
    ],
    "package_integrity": [
        {
            "filename": "squeez-1.40.0.tgz",
            "hashes": {
                "sha512_sri": "sha512-I/x0i/wE8ORytPV7v8TH8Hu3Nss3Ww1v9pMDhKc4HPLbhE2ClfSDqWJWb7nn0G0iyhpZozkYWM8U9q2ORPaLHQ==",
                "sha1": "4a41da65884c85232c1890c33bfab55917e350c3"
            }
        }
    ]
}