MAL-2026-4702

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/withdrawn/npm/vestibulect/MAL-2026-4702.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-4702
Withdrawn
2026-05-26T19:00:35Z
Published
2026-05-20T02:32:53Z
Modified
2026-05-27T00:32:08Z
Summary
Malicious code in vestibulect (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (82da0f0bb40f42e69defbea694db093f2ad880c8c094508f61e2d7fe58550e2e)

package.json declares a postinstall hook ("postinstall": "node install.js") which executes install.js automatically on npm install. install.js imports fs and https, enumerates the filesystem via fs.readdirSync(...) and reads file contents with fs.readFileSync(...), then performs outbound network calls via https.get(...). This combination — directory enumeration, file read, and unconditional outbound HTTPS in an install lifecycle script — is the canonical filesystem-to-network exfiltration shape and produces a direct attacker benefit: any developer or CI machine running npm install vestibulect has local file contents transmitted off-host to whatever destination the script chooses. The package has no advertised purpose that would justify reading local files at install time.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-003422",
            "import_time": "2026-05-26T05:50:36.802273352Z",
            "modified_time": "2026-05-20T02:32:53Z",
            "sha256": "82da0f0bb40f42e69defbea694db093f2ad880c8c094508f61e2d7fe58550e2e",
            "source": "amazon-inspector",
            "versions": [
                "0.0.1"
            ]
        },
        {
            "id": "IN-MAL-2026-003423",
            "import_time": "2026-05-26T05:50:36.899870932Z",
            "modified_time": "2026-05-20T02:32:53Z",
            "sha256": "f547a05c2fbb1c1520a8ef9fb763f154d5922146573fe178e9dfdccf1670ca09",
            "source": "amazon-inspector",
            "versions": [
                "0.0.1"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / vestibulect

Package

Name
vestibulect
View open source insights on deps.dev
Purl
pkg:npm/vestibulect

Affected ranges

Affected versions

0.*
0.0.1

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "domains": [
        "github.com",
        "release-assets.githubusercontent.com"
    ],
    "evidence_files": [
        {
            "path": "install.js",
            "sha256": "0705ac578ea2de9f689f7da9caac280446f2f71b059c2cdb294597e5bbe33d6e",
            "tlsh": "86f1408c56f31331427761da8a9b500ae1229043380fcd98bfac97867fd4638e597ef9"
        },
        {
            "path": "package.json",
            "sha256": "646bd3246183e667d0232546f6c5d1308e32c3216b341f3c80111430a3120e51",
            "tlsh": "7ee09220c8214d3369c45b944c6a650bb6520c5740147d2537e7101c8baf22e54bf22e"
        }
    ],
    "package_integrity": [
        {
            "filename": "vestibulect-0.0.1.tgz",
            "hashes": {
                "sha1": "471b937d0627de7d063abc83b7d6e50ff7a077fe",
                "sha512_sri": "sha512-XXAt5FHTHixmd3goN6RBhyB3z1hpEtEX7Dzhp1E+umeN/LQE8Jdz1WQo5myXNQLuGATgmxB7RqEoTKap2endrw=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/withdrawn/npm/vestibulect/MAL-2026-4702.json"