{
  "affected": [
    {
      "database_specific": {
        "cwes": [
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          }
        ],
        "indicators": {
          "evidence_files": [
            {
              "path": "index.js",
              "sha256": "c08be38bb6e1ba3768479d47f7ce329e377b784a3643df6c47fa0669d7c51290",
              "tlsh": "4a415594854263204eb087d86911d40ef6a6db77318487a5f9ee4bc42f736b060b2dbc"
            },
            {
              "path": "package.json",
              "sha256": "a1475d55065b992f6a47378f6fdc5fa20daef5e15719f16e8e872913b12a0e44",
              "tlsh": "4be026324d225a3329f006d2886b9486b2a08f3f10349c07b1bf092ca1e323198cf71d"
            }
          ],
          "package_integrity": [
            {
              "filename": "consumerweb-2200.4.2.tgz",
              "hashes": {
                "sha1": "6be4db6804fce71edf5bd292b19cbe80449d309e",
                "sha512_sri": "sha512-GcpqV5o7Bc+/50ZA1QGh1hLKLwVI7cyeKPWSf/dfRNFpHWboE3WCu+THFZnnxjgIa/ueOF3bkSuJFUlydye1tA=="
              }
            }
          ]
        }
      },
      "package": {
        "ecosystem": "npm",
        "name": "consumerweb"
      },
      "versions": [
        "2200.4.2"
      ]
    }
  ],
  "credits": [
    {
      "contact": [
        "inspector-research@amazon.com"
      ],
      "name": "Amazon Inspector",
      "type": "FINDER"
    },
    {
      "contact": [
        "https://www.reversinglabs.com"
      ],
      "name": "ReversingLabs",
      "type": "FINDER"
    }
  ],
  "database_specific": {
    "malicious-packages-origins": [
      {
        "id": "IN-MAL-2026-009726",
        "import_time": "2026-07-10T22:50:18.993077685Z",
        "modified_time": "2026-07-10T22:43:11Z",
        "sha256": "74612bbfc323641d0141b4f1b495d6ea5f9b52129f2391bf21c5fabf63702ca7",
        "source": "amazon-inspector",
        "versions": [
          "2200.4.2"
        ]
      },
      {
        "id": "RLMA-2026-05521",
        "import_time": "2026-07-20T13:14:45.134105299Z",
        "modified_time": "2026-07-20T10:38:09Z",
        "sha256": "87cc833287039635efd311bbe4ea455585c4d16ed331362cfa29b91d41d44680",
        "source": "reversing-labs",
        "versions": [
          "2200.4.2"
        ]
      }
    ]
  },
  "details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (74612bbfc323641d0141b4f1b495d6ea5f9b52129f2391bf21c5fabf63702ca7)\nOn `npm install`, both preinstall and postinstall lifecycle hooks execute index.js, which collects host reconnaissance (os.hostname(), os.userInfo().username, os.homedir(), current working directory, DNS servers from dns.getServers(), and package metadata) and exfiltrates it via DNS lookup and an HTTPS POST to a subdomain of oast.fun (interact.sh OAST collaborator). The package name and description (\u0027Internal App bUg b0UntY gollum22 h1\u0027) indicate a dependency-confusion attempt targeting an internal package name; any successful install both confirms the internal name is squattable and leaks identifying information about the installer\u0027s environment to the attacker\u0027s collaborator. No installer opt-in, no legitimate use case for the collected data going to an OAST endpoint.\n",
  "id": "MAL-2026-10181",
  "modified": "2026-07-20T13:16:55Z",
  "published": "2026-07-10T22:43:11Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/consumerweb/v/2200.4.2"
    }
  ],
  "schema_version": "1.7.4",
  "summary": "Malicious code in consumerweb (npm)"
}