MAL-2026-14356

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/lumen-pages-community/MAL-2026-14356.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-14356
Published
2026-08-21T22:11:02Z
Modified
2026-08-21T23:00:49.287084523Z
Summary
Malicious code in lumen-pages-community (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (b7c1d6b7b99791f7bbd5999021f109bef569a6c681eda0bb6196b459b12a3808)

lumen-pages-community@9.9.9 declares a postinstall hook (node dc.js) that runs automatically on npm install. dc.js collects the installer's hostname, username, current working directory, platform, Node version, CI environment variable, and npm user-agent, then issues an HTTPS GET to a hardcoded webhook.site collector URL (https://webhook.site/b00492c6-27ba-4ea0-a9cb-dd50b3770250/dc) with those fields as query parameters. The package name plus a 9.9.9 version and no library functionality matches the dependency-confusion shape: a high-version public namesake that catches internal-name resolution and phones home from any host that resolves it. A self-labeled 'research placeholder' framing in the package description does not change the runtime behavior — installer identifiers leave the host at install time to a third-party collector the installer did not opt into.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-018512",
            "modified_time": "2026-08-21T22:11:02Z",
            "versions": [
                "9.9.9"
            ],
            "source": "amazon-inspector",
            "import_time": "2026-08-21T22:42:49.933927379Z",
            "sha256": "b7c1d6b7b99791f7bbd5999021f109bef569a6c681eda0bb6196b459b12a3808"
        }
    ]
}
References
Credits

Affected packages

npm / lumen-pages-community

Package

Name
lumen-pages-community
View open source insights on deps.dev
Purl
pkg:npm/lumen-pages-community

Affected ranges

Affected versions

9.*
9.9.9

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/lumen-pages-community/MAL-2026-14356.json"
indicators 
{
    "evidence_files": [
        {
            "path": "dc.js",
            "sha256": "db09ea3714030d84eee4eb3d0f5f9ec1b3fcbcabc952726bac728ef03b5c3dad",
            "tlsh": "1021945b2166f42205b370d0375f220c61fae1228e82ea993428e2d4af346781252cfd"
        },
        {
            "path": "package.json",
            "sha256": "e5bc7e2ed956a118b24c8b6b0917c7dfccca953ea7e58962bd5427fe0b43fcd6",
            "tlsh": "22e07d444920523308d55ee94473514de1b10d5f110da905178351888298ff748b934f"
        }
    ],
    "package_integrity": [
        {
            "hashes": {
                "sha1": "93abca10f1876e86c6cd933b30f5b8ca9197dc8d",
                "sha512_sri": "sha512-kwA81Fg9Mv16OmkW5UT/TzxIfLzyGP5Er2ekuTkqGqPGqBs6WHaoLRlxrGPHsvTfLOAbdsmFwF2SnGLiKEecIg=="
            },
            "filename": "lumen-pages-community-9.9.9.tgz"
        }
    ]
}