MAL-2026-16541

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/zeal-util-hooks/MAL-2026-16541.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-16541
Published
2026-09-22T17:46:48Z
Modified
2026-09-30T01:00:06Z
Summary
Malicious code in zeal-util-hooks (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (2c9ed95500d2f1c637bcf47151a9220c0a81ee6cbd7a7aa4a8f66c74fed6e341)

postinstall.js and index.js load canary.js, which POSTs a JSON payload to https://npm-canary.aveliscare.com/beacon at install time and on require. The payload contains os.hostname(), os.userInfo() username, cwd, process.platform, node version, npm user agent, parent package name/version, and a fixed allowlist of CI-identifier env vars (GITHUB_REPOSITORY, GITHUB_ACTOR, GITHUB_REF, GITHUB_RUN_ID, EAS/VERCEL/BUILDKITE identifiers). The endpoint is overridable via ZEAL_CANARY_URL but defaults to the hardcoded aveliscare.com host. The package advertises publisher Zeal (getzeal.io, github.com/zeal-io); the beacon destination aveliscare.com does not match that publisher. The collected fields are host/CI identifiers rather than credentials or filesystem contents, and no code execution, credential read, or persistent artifact is present. The install-time/require-time outbound network without opt-out breaks air-gapped installs, and the publisher/destination-domain mismatch is the shape typical of a dependency-confusion canary used to log where a placeholder name resolves.

Database specific 
{
    "malicious-packages-origins":  [
        {
            "id":  "RLMA-2026-10815",
            "import_time":  "2026-09-24T09:21:36.731977575Z",
            "modified_time":  "2026-09-22T17:46:48Z",
            "sha256":  "aadbcafaeb12ab9324d6bffe1b9c7bbe510663d033aaf4ff9b5ad5fee94156f9",
            "source":  "reversing-labs",
            "versions":  [
                "0.0.0"
            ]
        },
        {
            "id":  "IN-MAL-2026-020747",
            "import_time":  "2026-09-30T00:52:54.321628003Z",
            "modified_time":  "2026-09-30T00:31:32Z",
            "sha256":  "2c9ed95500d2f1c637bcf47151a9220c0a81ee6cbd7a7aa4a8f66c74fed6e341",
            "source":  "amazon-inspector",
            "versions":  [
                "0.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / zeal-util-hooks

Package

Name
zeal-util-hooks
View open source insights on deps.dev
Purl
pkg:npm/zeal-util-hooks

Affected ranges

Affected versions

0.*
0.0.0

Database specific

cwes 
[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files":  [
        {
            "path":  "canary.js",
            "sha256":  "313f6afebeb44640d7df7a1995d0958bed918ecf2be8f171d4fbfe8dcab91f1d",
            "tlsh":  "acd1d86613f052762b8206b4591f00979736e027722aa170f5af92143f4a6bc87f3deb"
        }
    ],
    "package_integrity":  [
        {
            "filename":  "zeal-util-hooks-0.0.0.tgz",
            "hashes":  {
                "sha1":  "80cf18c7b742245379c6d2bf645fb9cc8ed80758",
                "sha512_sri":  "sha512-7eDJoy6Q/vblvlqgsv2+tECIgmge0lB0iSQyXRxim8s80e/NIxRCY+TEmDTHb+3gxQNosTu4Rk37lwD2cJHaxw=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/zeal-util-hooks/MAL-2026-16541.json"