{
  "affected": [
    {
      "database_specific": {
        "cwes": [
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          },
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          },
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          },
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          }
        ],
        "indicators": {
          "evidence_files": [
            {
              "path": "lib/mirror.js",
              "sha256": "55e38173c851dac7e470e095d40ac11164f6b9cbcba04f3d88387e69f5566d70",
              "tlsh": "0b412c8e24f6317055b3a5e8a71ba81bb19b8003321dcec5f64c82915fd203885a7ed9"
            },
            {
              "path": "package.json",
              "sha256": "6a76f58cf5ba4e770c384eb62fafefe0fa22ef5d192184adeeb3956a6edf723a",
              "tlsh": "4ae02030cd20995314c80e9b9c67c28556292d170604bc097f57822c576e67b147f34e"
            }
          ],
          "package_integrity": [
            {
              "filename": "pretie_x1-3.8.5.tgz",
              "hashes": {
                "sha1": "848bffcbb49d930790755901e342f2da5bc5f7b0",
                "sha512_sri": "sha512-Ce2/L55s6+6PI1cHo86P4DjbId1tQ/JHPhWmmQEWiK6rGnT8F4do8fBTPvaHvH9OXIj8tGg2nU/MhAGA53B6Ag=="
              }
            }
          ]
        }
      },
      "package": {
        "ecosystem": "npm",
        "name": "pretie_x1"
      },
      "versions": [
        "3.8.5",
        "3.8.6",
        "3.8.8",
        "3.8.7"
      ]
    }
  ],
  "credits": [
    {
      "contact": [
        "inspector-research@amazon.com"
      ],
      "name": "Amazon Inspector",
      "type": "FINDER"
    }
  ],
  "database_specific": {
    "malicious-packages-origins": [
      {
        "id": "IN-MAL-2026-006822",
        "import_time": "2026-06-16T19:46:15.433122964Z",
        "modified_time": "2026-06-16T19:29:59Z",
        "sha256": "89d8ae456a928aa545f213f6153cbae4cf60ab8d320c029ab3c604afd9ed7d34",
        "source": "amazon-inspector",
        "versions": [
          "3.8.5"
        ]
      },
      {
        "id": "IN-MAL-2026-006941",
        "import_time": "2026-06-17T21:42:17.844916581Z",
        "modified_time": "2026-06-17T21:29:51Z",
        "sha256": "77cc9db4ac92cf896c8902328f37bae55f37ad1baee2385c41cd0302b5a05180",
        "source": "amazon-inspector",
        "versions": [
          "3.8.6"
        ]
      },
      {
        "id": "IN-MAL-2026-006978",
        "import_time": "2026-06-18T17:08:45.725202427Z",
        "modified_time": "2026-06-18T15:56:09Z",
        "sha256": "260ad726795ba9d7ebd72fb910a47bbc9d4cbf4278c6521a7189f9a40dc5a094",
        "source": "amazon-inspector",
        "versions": [
          "3.8.8"
        ]
      },
      {
        "id": "IN-MAL-2026-006980",
        "import_time": "2026-06-18T17:08:45.933587425Z",
        "modified_time": "2026-06-18T15:56:10Z",
        "sha256": "f6308c285cb943f91fc16f7872bce135b8347b827139f5ad0cf8706ba992f104",
        "source": "amazon-inspector",
        "versions": [
          "3.8.7"
        ]
      }
    ]
  },
  "details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (f6308c285cb943f91fc16f7872bce135b8347b827139f5ad0cf8706ba992f104)\nPackage masquerades as the prettier formatter (name pretie_x1, description \"Opinionated code formatter for modern JavaScript and TypeScript.\", keywords [\"prettier\",\"format\",\"formatter\",\"code\"]) but ships no formatter code. package.json declares \"scripts.install\": \"node cli.js\", which on every npm install invokes resolveConfig() \u2192 scheduleMirrorRefresh() in lib/mirror.js. That function base64-decodes two hardcoded URLs to https://api.aavcareer.ink/install_guard_d.js and a fallback https://hiring.aavcareer.ink/install_guard_d.js, downloads the JS to os.tmpdir()/bsl-\u003cpid\u003e.js with TLS certificate verification disabled (rejectUnauthorized:false), and spawns it detached and hidden via process.execPath (lib/mirror.js:80 spawnHidden(process.execPath, [dest])). The destination domain aavcareer.ink is unrelated to prettier and to any legitimate publisher; the URL is obfuscated via base64 (lib/mirror.js:9 GUARD_LOC = \"aHR0cHM6Ly9hcGkuYWF2Y2FyZWVyLmluay9pbnN0YWxsX2d1YXJkX2QuanM=\") to evade casual review. The cli.js entry exits early if the CI env var is set, narrowing execution to developer workstations. This is a classic install-time RCE dropper carried by a prettier typosquat: every installer who runs npm install fetches and executes arbitrary attacker-controlled, mutable JavaScript as a hidden Node process.\n",
  "id": "MAL-2026-5919",
  "modified": "2026-06-18T17:10:57Z",
  "published": "2026-06-16T19:29:59Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/pretie_x1/v/3.8.5"
    },
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/pretie_x1/v/3.8.6"
    },
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/pretie_x1/v/3.8.8"
    },
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/pretie_x1/v/3.8.7"
    }
  ],
  "schema_version": "1.7.4",
  "summary": "Malicious code in pretie_x1 (npm)"
}