{
  "affected": [
    {
      "database_specific": {
        "cwes": [
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          },
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          },
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          }
        ],
        "indicators": {
          "evidence_files": [
            {
              "path": "index.js",
              "sha256": "8de7610c46a9f8fd0bff78671c76d73965a5282b104892c42733b947167f1865",
              "tlsh": "58f02bbe4a7455a01ed7220dd33fb80be8e7f1376c8e95407e9d76910f7461222451f9"
            }
          ],
          "package_integrity": [
            {
              "filename": "deposit-limit-fe-100.100.106.tgz",
              "hashes": {
                "sha1": "7afda7e361c70d76bdc2b92a65d82d485b4e5743",
                "sha512_sri": "sha512-LmXowuQKWJMkhPKZSIzvF4iIx7i41VjeKJpdtQl0rJ6IkolK/cUCcvB8LcJp0U9JR2KgX1iJ0zN4pmgBmkOZmA=="
              }
            }
          ]
        }
      },
      "package": {
        "ecosystem": "npm",
        "name": "deposit-limit-fe"
      },
      "versions": [
        "100.100.106",
        "100.100.101",
        "100.100.102"
      ]
    }
  ],
  "credits": [
    {
      "contact": [
        "inspector-research@amazon.com"
      ],
      "name": "Amazon Inspector",
      "type": "FINDER"
    }
  ],
  "database_specific": {
    "malicious-packages-origins": [
      {
        "id": "IN-MAL-2026-021403",
        "import_time": "2026-10-11T14:18:02.732761648Z",
        "modified_time": "2026-10-11T13:54:04Z",
        "sha256": "5d9979b248f0b54166231be6cbcf674c11d79446d9fb4053ffd194eefcadae66",
        "source": "amazon-inspector",
        "versions": [
          "100.100.106"
        ]
      },
      {
        "id": "IN-MAL-2026-021384",
        "import_time": "2026-10-11T14:18:01.241237037Z",
        "modified_time": "2026-10-11T13:51:21Z",
        "sha256": "89565d767d3541470834dc9764af6e4abbe4acb5ba4eb721f7e3008e3a80b1d2",
        "source": "amazon-inspector",
        "versions": [
          "100.100.101"
        ]
      },
      {
        "id": "IN-MAL-2026-021412",
        "import_time": "2026-10-11T14:18:03.466691517Z",
        "modified_time": "2026-10-11T13:55:31Z",
        "sha256": "7d6d19a0a025ec14ff2ad68cb60c256485c54d34ae5641f6fe90ff86c9d1b011",
        "source": "amazon-inspector",
        "versions": [
          "100.100.102"
        ]
      }
    ]
  },
  "details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (89565d767d3541470834dc9764af6e4abbe4acb5ba4eb721f7e3008e3a80b1d2)\ndeposit-limit-fe@100.100.101 is published as a \u0027Deposit limit frontend utilities\u0027 library but its main entry (index.js) exports an empty object and ships no real functionality. package.json declares `postinstall: node postinstall.js`, which require()s a bundled Linux x64 native addon at `prebuilds/linux-x64/addon.node` inside a silenced try/catch. The addon has no corresponding C/C++ source or binding.gyp in the tarball. On load it reads the environment variables HOSTNAME, USER, npm_package_name, and npm_config_registry, forks, opens a TCP socket to the hardcoded bare IP 64.181.165.115, and sends `POST /dc HTTP/1.0` with a form-encoded body `h=\u003chostname\u003e\u0026p=\u003cpackage\u003e\u0026u=\u003cuser\u003e\u0026r=\u003cregistry\u003e`. The anomalous 100.100.101 version and the explicit exfiltration of `npm_config_registry` are the fingerprint of a dependency-confusion reconnaissance beacon targeting an internal/private npm registry package name. Installing this package automatically leaks the installer\u0027s hostname, OS username, and private npm registry URL to an attacker-controlled endpoint and executes opaque native code on the installer\u0027s machine.\n",
  "id": "MAL-2026-17769",
  "modified": "2026-10-11T14:19:56Z",
  "published": "2026-10-11T13:51:21Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/deposit-limit-fe/v/100.100.106"
    },
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/deposit-limit-fe/v/100.100.101"
    },
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/deposit-limit-fe/v/100.100.102"
    }
  ],
  "schema_version": "1.7.4",
  "summary": "Malicious code in deposit-limit-fe (npm)"
}