MAL-2026-13460

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/stretchshop/MAL-2026-13460.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13460
Published
2026-08-06T15:34:27Z
Modified
2026-08-06T23:50:22Z
Summary
Malicious code in stretchshop (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (479c1238e6380db5463eb3755b980f963d269b2b0874d464b9e1b3b65bd03f60)

package.json declares a postinstall hook that runs node demo/demo.js base, which shell-invokes git clone https://github.com/Wradgio/StretchShop-demo-data.git at mutable HEAD (no commit SHA, no tag, no integrity check) and then childProcess.forks db/demo_data.js from the freshly cloned tree. The cloned repository is owned by the personal GitHub account Wradgio, which does not match the package's publisher scope StretchShop. Whoever controls that GitHub account can push arbitrary JavaScript to the default branch and have it executed on every fresh top-level install of stretchshop@0.7.5.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-016653",
            "import_time": "2026-08-06T18:09:01.76413629Z",
            "modified_time": "2026-08-06T15:34:27Z",
            "sha256": "479c1238e6380db5463eb3755b980f963d269b2b0874d464b9e1b3b65bd03f60",
            "source": "amazon-inspector",
            "versions": [
                "0.7.5"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / stretchshop

Package

Name
stretchshop
View open source insights on deps.dev
Purl
pkg:npm/stretchshop

Affected ranges

Affected versions

0.*
0.7.5

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "demo/demo.js",
            "sha256": "f9d9f5c071ef5a76e0e379db50a96b4c5fc5511c639912d09175317d87c19f9a",
            "tlsh": "e69176435bcc072475e42657bc16099b11ed82b1e8b07d1898ddc9f631a78ec664eeb2"
        }
    ],
    "package_integrity": [
        {
            "filename": "stretchshop-0.7.5.tgz",
            "hashes": {
                "sha1": "c13ad6b55e44ff8862790baa43fd06c38b764236",
                "sha512_sri": "sha512-2314vzjdcvwgVJa3KyxcmHcVuMpthLLN6EA4dQN/4wTvga9szP9w/YnisjR3k1ehujp/Z9ZXjsS0xSeC7mc3bA=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/stretchshop/MAL-2026-13460.json"