MAL-2026-14016

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/preinstall-hook-webhook-callback-demo/MAL-2026-14016.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-14016
Published
2026-08-13T21:54:42Z
Modified
2026-08-13T22:30:12.558362478Z
Summary
Malicious code in preinstall-hook-webhook-callback-demo (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (d6e707d55368c2628038e0efaac35629fba6dbd520e66a7e29f9c6a86c69b2e1)

package.json declares a preinstall lifecycle script that contacts webhook.site, an ephemeral request-capture service commonly used as an attacker-controlled exfiltration sink. The hook fires automatically on npm install before any user interaction, and webhook.site is not a first-party or documented destination for any legitimate build or runtime purpose of this package. The combination of an auto-executing preinstall script wired to an out-of-band capture endpoint is the shape of installer-side data exfiltration / callback beaconing at install time.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-017712",
            "import_time": "2026-08-13T22:20:21.59739106Z",
            "sha256": "037c89bf149ea8deefcf9cba562b080ad8046120e0b9f722a66b61af58c2f4ef",
            "versions": [
                "1.0.1"
            ],
            "source": "amazon-inspector",
            "modified_time": "2026-08-13T21:54:55Z"
        },
        {
            "id": "IN-MAL-2026-017711",
            "import_time": "2026-08-13T22:20:21.500983972Z",
            "sha256": "d6e707d55368c2628038e0efaac35629fba6dbd520e66a7e29f9c6a86c69b2e1",
            "modified_time": "2026-08-13T21:54:42Z",
            "source": "amazon-inspector",
            "versions": [
                "1.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / preinstall-hook-webhook-callback-demo

Package

Name
preinstall-hook-webhook-callback-demo
View open source insights on deps.dev
Purl
pkg:npm/preinstall-hook-webhook-callback-demo

Affected ranges

Affected versions

1.*
1.0.0
1.0.1

Database specific

cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "package.json",
            "tlsh": "e8017b38ca12a93128d49bf50a17414712a1882b4a603d49b7cb417d8f5f61f44bf31f",
            "sha256": "44457e693878895b1248648ee589ad6cb57f43d29f8fad37a95d66b588a02751"
        }
    ],
    "package_integrity": [
        {
            "filename": "preinstall-hook-webhook-callback-demo-1.0.1.tgz",
            "hashes": {
                "sha1": "16188ac17c7f5c51f20ebc99a2893f521f94fe26",
                "sha512_sri": "sha512-SehacCDUJu+kGoZm4vn9Y0nws861XTISgJ8IOvbSQJ5ey03kRB7PBqdbHJysUK//KnpQryDHMMClmMNL/4Y8Kg=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/preinstall-hook-webhook-callback-demo/MAL-2026-14016.json"