MAL-2026-18106

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/memories-core-web/MAL-2026-18106.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-18106
Published
2026-10-20T18:45:24Z
Modified
2026-10-20T19:00:04Z
Summary
Malicious code in memories-core-web (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (5aa2bc32ff519468287f8a87deeff1349332b710735b9f78ee34ffd46c9511cb)

package.json declares a preinstall lifecycle script that runs curl to a hardcoded webhook.site collector URL (https://webhook.site/b2967b0a-1b24-4670-8ae1-e09e3cf272c4/) with the installer's hostname and username interpolated as query parameters via $(hostname) and $(whoami). This fires automatically on npm install and transmits installer host identifiers to a third-party collector controlled by whoever provisioned the webhook.site endpoint. The destination is a generic request-capture service, not infrastructure associated with any declared publisher, and the data flow is unconditional on install.

Database specific 
{
    "malicious-packages-origins":  [
        {
            "id":  "IN-MAL-2026-021547",
            "import_time":  "2026-10-20T18:46:13.60627499Z",
            "modified_time":  "2026-10-20T18:45:24Z",
            "sha256":  "5aa2bc32ff519468287f8a87deeff1349332b710735b9f78ee34ffd46c9511cb",
            "source":  "amazon-inspector",
            "versions":  [
                "99.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / memories-core-web

Package

Name
memories-core-web
View open source insights on deps.dev
Purl
pkg:npm/memories-core-web

Affected ranges

Affected versions

99.*
99.0.0

Database specific

cwes 
[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files":  [
        {
            "path":  "package.json",
            "sha256":  "8ddcc8c2ddf9a283c107dda4a4d7aa4f375750f4bef10d693edf6393436c5396",
            "tlsh":  "3bf09ea52808a1373ec442f32a71914f6724ef4a5254ae1c8bd60098924eab7837bce9"
        }
    ],
    "package_integrity":  [
        {
            "filename":  "memories-core-web-99.0.0.tgz",
            "hashes":  {
                "sha1":  "5e1f145d6c10fced443475e8750debc53b722638",
                "sha512_sri":  "sha512-K9qAI4IBxrJ1QzkSPqgjTemexseJSO0cUoi2FObTKTfhlCpTgWHznlMwnIy7sZIthVB2TVOwaexe66TI/bgpuQ=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/memories-core-web/MAL-2026-18106.json"