MAL-2026-5444

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/grateful-checkout/MAL-2026-5444.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-5444
Published
2026-06-09T17:44:52Z
Modified
2026-06-09T18:01:36Z
Summary
Malicious code in grateful-checkout (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (c2a9600ad3ee3fddd9f06425260c94edf660263800080787155a63d3e5212d12)

On npm install, the postinstall hook in src/canary.js performs a DNS lookup and an HTTPS GET to a serveo tunnel host (96e03fa6c292469a-172-245-86-254.serveousercontent.com/canary-install?pkg=...&ver=...), leaking the installer's source IP and the resolved package name/version to a third-party endpoint without consent. The package's README falsely claims that no data is collected or transmitted. The package additionally impersonates the API surface of an internal Exodus checkout-signing module (generateMnemonicSigningKeys, signDirectPaymentMultiChain, signCapture, signRefund, signCharge, signCancelSubscription) to land via dependency confusion against private name resolution. While self-described as a security research PoC, the behavior — uncontracted outbound network from a lifecycle hook to a researcher-controlled tunnel and namespace impersonation of a private package — is installer-harming regardless of intent.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-005118",
            "import_time": "2026-06-09T17:45:55.450487445Z",
            "modified_time": "2026-06-09T17:44:53Z",
            "sha256": "09b2768ea8a2c0f9038e40a8109ae744ca38de664099bfa1fdf128790baeb67d",
            "source": "amazon-inspector",
            "versions": [
                "99.0.0-canary.1"
            ]
        },
        {
            "id": "IN-MAL-2026-005117",
            "import_time": "2026-06-09T17:45:55.417984745Z",
            "modified_time": "2026-06-09T17:44:52Z",
            "sha256": "c2a9600ad3ee3fddd9f06425260c94edf660263800080787155a63d3e5212d12",
            "source": "amazon-inspector",
            "versions": [
                "99.0.0-canary.1"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / grateful-checkout

Package

Name
grateful-checkout
View open source insights on deps.dev
Purl
pkg:npm/grateful-checkout

Affected ranges

Affected versions

99.*
99.0.0-canary.1

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "domains": [
        "96e03fa6c292469a-172-245-86-254.serveousercontent.com"
    ],
    "evidence_files": [
        {
            "path": "src/canary.js",
            "sha256": "16502b9065d4976ebb34fd49d0fb75f3cd0e64cf8d35872b419a6b6752485d51",
            "tlsh": "37e06ffe4fd0a33a56701bc9f080a54fe707e3283085a2c1d69822a249c28f0ae218f0"
        },
        {
            "path": "src/index.js",
            "sha256": "8df05b04ab1173592b08d71dea34f5998519f445526493f61ab3dd9dc0145a5a",
            "tlsh": "63e07d5f0961337a1d8bd441d49794213fa2560ad0fd89a60c8d521f75035348eff0c5"
        }
    ],
    "package_integrity": [
        {
            "filename": "grateful-checkout-99.0.0-canary.1.tgz",
            "hashes": {
                "sha1": "f35d99228efe7e033866668f74f68ce1f83f0216",
                "sha512_sri": "sha512-AU5YHWJwgf73skXr4vResekpEjCTcjkKUsuUi781cHDpg2v+BeXDrmqjeq58HvUT0yBPZioQ2JsKKSVFe1o3pw=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/grateful-checkout/MAL-2026-5444.json"