MAL-2026-13742

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/zeal-rq-hooks/MAL-2026-13742.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13742
Published
2026-08-11T17:22:07Z
Modified
2026-08-11T17:30:12Z
Summary
Malicious code in zeal-rq-hooks (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (dcf7e926ec85f72f362263a19d4f99c4b215ddd94ed4454c669c3387cacee164)

The package includes canary.js which imports os/http/https and, at line 123, POSTs a JSON body containing os.hostname(), os.userInfo(), process.platform, node/npm version, and cwd to the hardcoded endpoint https://npm-canary.aveliscare.com. The hostname is not associated with the npm registry or a documented publisher and is embedded directly in the package's own shipped code. The collected fields (hostname, username, platform, cwd) are host-identifying reconnaissance data, and the network destination is not user-configurable in the flagged code path.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-017374",
            "import_time": "2026-08-11T17:24:19.528788019Z",
            "modified_time": "2026-08-11T17:22:07Z",
            "sha256": "dcf7e926ec85f72f362263a19d4f99c4b215ddd94ed4454c669c3387cacee164",
            "source": "amazon-inspector",
            "versions": [
                "0.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / zeal-rq-hooks

Package

Name
zeal-rq-hooks
View open source insights on deps.dev
Purl
pkg:npm/zeal-rq-hooks

Affected ranges

Affected versions

0.*
0.0.0

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "canary.js",
            "sha256": "313f6afebeb44640d7df7a1995d0958bed918ecf2be8f171d4fbfe8dcab91f1d",
            "tlsh": "acd1d86613f052762b8206b4591f00979736e027722aa170f5af92143f4a6bc87f3deb"
        }
    ],
    "package_integrity": [
        {
            "filename": "zeal-rq-hooks-0.0.0.tgz",
            "hashes": {
                "sha1": "ce5a93755c893ec85f8160daf5992369b4e0154b",
                "sha512_sri": "sha512-W7k44IcqJxuqqQA3Y0DTWO8eAeVVfQRu36cM6dYy1qbXmthEjAgToGboUZqxFpMEWWgihEoLrcA8KfuiSoxEmw=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/zeal-rq-hooks/MAL-2026-13742.json"