MAL-2026-5894

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/create-vercel-integration/MAL-2026-5894.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-5894
Published
2026-06-16T15:27:53Z
Modified
2026-06-16T16:16:49Z
Summary
Malicious code in create-vercel-integration (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (aeaea6bab6360c38ed5a7de7065eb04d0ac489bb3670b68defc8bc26874d3d62)

Package name mimics Vercel's official create-* initializer convention (e.g. create-next-app), targeting developers who mistype or guess the initializer name and invoke npx create-vercel-integration. The bin script (bin/run.js) hardcodes a callback URL https://deepbounty.dd06-dev.fr/cb/f7506d76-f300-4c91-a105-41c07ad317fc and, on invocation, reads the INIT_CWD environment variable, extracts its basename, and POSTs {pkg, timestamp, transport, project} to that author-controlled endpoint. The package self-describes as a 'Bug Bounty PoC,' but it is published on the public npm registry under a name shaped like an official Vercel scaffold and silently leaks the installer's project directory name to a third party with no disclosure or opt-out. The package provides no legitimate Vercel-integration scaffolding functionality; the bin's only effect is the beacon.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-006757",
            "import_time": "2026-06-16T16:06:33.55007693Z",
            "modified_time": "2026-06-16T15:27:53Z",
            "sha256": "aeaea6bab6360c38ed5a7de7065eb04d0ac489bb3670b68defc8bc26874d3d62",
            "source": "amazon-inspector",
            "versions": [
                "1.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / create-vercel-integration

Package

Name
create-vercel-integration
View open source insights on deps.dev
Purl
pkg:npm/create-vercel-integration

Affected ranges

Affected versions

1.*
1.0.0

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "bin/run.js",
            "sha256": "9f06a6c1406fc7dee80c6b0d18fa3ddbe9770793dba4cb1660a7f23d8a588583",
            "tlsh": "da2184806ad2573422ea1ad1995b9c0fb327b10b3e41f0a8b99c418d1fc813c6573fce"
        }
    ],
    "package_integrity": [
        {
            "filename": "create-vercel-integration-1.0.0.tgz",
            "hashes": {
                "sha1": "60ec00cb404eda06647b60a0060b41de832da0de",
                "sha512_sri": "sha512-ZtTzD6xdUJZ2Pf5OCFxKu/1YOU6ibHVibN2tYnwPv5pWu032t8CTxj9YY1+Vn/f2lUgAs90DE+C7s2p9QRu+rg=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/create-vercel-integration/MAL-2026-5894.json"