MAL-2026-4637

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/pewter-constants/MAL-2026-4637.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-4637
Published
2026-05-23T17:41:32Z
Modified
2026-05-26T06:02:49Z
Summary
Malicious code in pewter-constants (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (3c9f898fe8ed95b1d549bfff91d7c0dda0f75ada1c32a58af144940cf28b23c5)

On npm install, a preinstall hook in callback.js collects os.hostname(), os.userInfo().username, process.cwd(), the configured npm registry (npm_config_registry), and CI repo identifiers (GITHUB_REPOSITORY, CI_PROJECT_PATH, BUILD_REPOSITORY_NAME) and HTTP-GETs them to http://75.119.137.232:31337/depconfuse. The package is shaped as a dependency-confusion squat: version 9999.0.0 to win semver resolution against an internal package of the same name, an empty index.js (module.exports = {}), and placeholder author/description metadata (Security Researcher, Security research placeholder). Any build that resolves pewter-constants from the public registry will install this package and silently leak its internal registry URL, CI repo path, and host/user identity to a third-party operator over plain HTTP. The 'security research' framing in the metadata does not change the installer-side impact — internal infrastructure is fingerprinted and disclosed without consent.

Database specific 
{
    "malicious-packages-origins":  [
        {
            "id":  "IN-MAL-2026-004369",
            "import_time":  "2026-05-26T05:52:27.907183724Z",
            "modified_time":  "2026-05-23T17:41:32Z",
            "sha256":  "3c9f898fe8ed95b1d549bfff91d7c0dda0f75ada1c32a58af144940cf28b23c5",
            "source":  "amazon-inspector",
            "versions":  [
                "9999.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / pewter-constants

Package

Name
pewter-constants
View open source insights on deps.dev
Purl
pkg:npm/pewter-constants

Affected ranges

Affected versions

9999.*
9999.0.0

Database specific

cwes 
[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files":  [
        {
            "path":  "callback.js",
            "sha256":  "681fd66df6380f3163de0c70cf621b81ada674401bd842b230dacd856933760a",
            "tlsh":  "1901bde9828858341cc313c4be956c1e98d7d3523283d4c2ab1d31e167531b486f65b9"
        },
        {
            "path":  "package.json",
            "sha256":  "e9f0be861735561b1077eb4480e2423b803d53550cd916e30663e47342a2b1c6",
            "tlsh":  "f3e06814381468332cf686e504719256a065cd1f641a3c0ea746008ce38efdb82fb19e"
        }
    ],
    "package_integrity":  [
        {
            "filename":  "pewter-constants-9999.0.0.tgz",
            "hashes":  {
                "sha1":  "aa893fd3ec98b42fabdd658e5434d0029b6f8458",
                "sha512_sri":  "sha512-53NZh6fSnlnjnh8sr14zXFOJPp/I/eHg8J3jEpcDXaektjPfcLDo8wP9kSKG9wzKfSB9/AzbAujalxElFb75Hg=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/pewter-constants/MAL-2026-4637.json"