MAL-2026-16216

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/tetomood/MAL-2026-16216.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-16216
Published
2026-09-16T06:35:38Z
Modified
2026-09-16T07:00:07Z
Summary
Malicious code in tetomood (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (6c09686feb7c38e815ef9a615a6ceba2444029a34ea9d6bee8598a76bc8e8f92)

package.json declares both preinstall and postinstall scripts that invoke wget to POST the installer's current working directory ($(pwd)) and machine hostname ($(hostname)) to a hardcoded Discord webhook endpoint on discord.com at install time. The tarball ships only package.json (611 bytes); the declared main entry index.js is absent, so the package has no legitimate functionality — the lifecycle beacons are its sole purpose. Installing the package causes automatic host reconnaissance data to be sent to an author-controlled remote endpoint without consent.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-020086",
            "import_time": "2026-09-16T06:56:08.843090937Z",
            "modified_time": "2026-09-16T06:35:38Z",
            "sha256": "6c09686feb7c38e815ef9a615a6ceba2444029a34ea9d6bee8598a76bc8e8f92",
            "source": "amazon-inspector",
            "versions": [
                "12.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / tetomood

Package

Name
tetomood
View open source insights on deps.dev
Purl
pkg:npm/tetomood

Affected ranges

Affected versions

12.*
12.0.0

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "package.json",
            "sha256": "6dd2fe7c4dc3b92baca6b52f1cf89fff5b3211862346a9c12ff668cb504595dd",
            "tlsh": "1cf0acf25d10e572bbcb0ea63ad29a4a7aa39d4f1881163cd1034b0c03ce36f10b1a46"
        }
    ],
    "package_integrity": [
        {
            "filename": "tetomood-12.0.0.tgz",
            "hashes": {
                "sha1": "5cd6977336999b4253f6f41b7acf3a7219d3f70a",
                "sha512_sri": "sha512-Xj2Hkfw/BbWGGloD+hhQF25xzK2lK/a+BFzrV6+Fd3RnIkng927oY5dyV2y3jUJjkEYnNmF5Y3yi/MofMSGIcg=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/tetomood/MAL-2026-16216.json"