MAL-2026-18288

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/jshelperdependenceny/MAL-2026-18288.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-18288
Published
2026-10-25T15:11:25Z
Modified
2026-10-25T15:30:04Z
Summary
Malicious code in jshelperdependenceny (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (dc4d19697f4104351bb25b7e568018ec6ed85d626b7265fb4b9682ae12183be9)

npm package 'jshelperdependenceny' is published at version 99.0.0 with a preinstall banner stating it is intended to shadow an internal v1.0.0 package of the same name — the classic dependency-confusion shape of using an inflated version to win resolution against a private registry. On install, package.json runs 'node preinstall.js || true', which collects os.hostname(), os.platform(), os.arch(), and the package name/version and POSTs them as JSON to a URL taken from the DC_CALLBACK_URL environment variable, defaulting to http://127.0.0.1:5656/exfil. The env-var override turns the loopback default into a functional attacker-configurable beacon that fires automatically on npm install and discloses installer host identifiers plus confirmation that the shadowed internal name resolved to this public artifact.

Database specific 
{
    "malicious-packages-origins":  [
        {
            "id":  "IN-MAL-2026-021708",
            "import_time":  "2026-10-25T15:15:15.735847913Z",
            "modified_time":  "2026-10-25T15:11:25Z",
            "sha256":  "dc4d19697f4104351bb25b7e568018ec6ed85d626b7265fb4b9682ae12183be9",
            "source":  "amazon-inspector",
            "versions":  [
                "99.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / jshelperdependenceny

Package

Name
jshelperdependenceny
View open source insights on deps.dev
Purl
pkg:npm/jshelperdependenceny

Affected ranges

Affected versions

99.*
99.0.0

Database specific

cwes 
[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files":  [
        {
            "path":  "preinstall.js",
            "sha256":  "d488b536febbb35576cf33efe029f8ffa868385e41a93a03f5191ec52d8660b4",
            "tlsh":  "7681a8b24490772127aace8410b2fc6e532975d0e9326814f9cd65c42ffe964de22df7"
        },
        {
            "path":  "package.json",
            "sha256":  "5b10d51a2d0e72d6033fcc5fe9c54944af469fa80b9d32febead0f87f55c19e9",
            "tlsh":  "25e0c2344d24b43319f44bd069975116b5a10e1a42587c1c67e7202b02be7b349bfa2e"
        }
    ],
    "package_integrity":  [
        {
            "filename":  "jshelperdependenceny-99.0.0.tgz",
            "hashes":  {
                "sha1":  "f231f901c512837ed3afe7dc32a6dd958b919c6c",
                "sha512_sri":  "sha512-glsd4SZCEss3PWy3s1tLVIcjCA0+2+KoO3Ib0uYftuph2cWFv6S56aaCwJ2/DmKW3q7uLlfUltA4o3WtVztUsg=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/jshelperdependenceny/MAL-2026-18288.json"