{
  "affected": [
    {
      "database_specific": {
        "cwes": [
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          }
        ],
        "indicators": {
          "evidence_files": [
            {
              "path": "package.json",
              "sha256": "7b3b2ec88dcfcbedaee1fe536abb9e4b78f51018ca104128c33522f9880a0009",
              "tlsh": "ebc0123058115e3315cd4b5a7979854665614e1f5055e4148393151841ee3f6a8ef70e"
            }
          ],
          "package_integrity": [
            {
              "filename": "electron-internal-utils-1.0.0.tgz",
              "hashes": {
                "sha1": "7c26f177a6a10e422b56f24090dab181a3c067a3",
                "sha512_sri": "sha512-krKMzUJSU9Ef56nrOpmQ+an6PPZNbYq3I5s4CMOmqoUzlpm/FhBw6Omx+ZwojIU4XdHZVrbp3BrLTDgzHHkPyw=="
              }
            }
          ]
        }
      },
      "package": {
        "ecosystem": "npm",
        "name": "electron-internal-utils"
      },
      "versions": [
        "1.0.0"
      ]
    }
  ],
  "credits": [
    {
      "contact": [
        "inspector-research@amazon.com"
      ],
      "name": "Amazon Inspector",
      "type": "FINDER"
    }
  ],
  "database_specific": {
    "malicious-packages-origins": [
      {
        "id": "IN-MAL-2026-007049",
        "import_time": "2026-06-19T05:16:49.090375831Z",
        "modified_time": "2026-06-19T04:56:31Z",
        "sha256": "e07ff16a8f4a44a8ccfc2f6f2a91eee6dbd3d1de9f1c4d6ca95e0e48999202ef",
        "source": "amazon-inspector",
        "versions": [
          "1.0.0"
        ]
      }
    ]
  },
  "details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (e07ff16a8f4a44a8ccfc2f6f2a91eee6dbd3d1de9f1c4d6ca95e0e48999202ef)\nOn npm install, package.json\u0027s postinstall script executes `curl http://9ph8dp.ceye.io`, an out-of-band DNS/HTTP interaction service controlled by the package author. The callback signals the attacker that the package was installed on the host and leaks the installer\u0027s public IP and DNS resolver metadata. The package ships no functionality (index.js contains only `module.exports = {};`) and its name impersonates the Electron project\u0027s internal-utilities namespace, consistent with a dependency-confusion attack against projects that reference internal Electron helpers. Any environment that runs `npm install` on this package will silently beacon to attacker-controlled infrastructure.\n",
  "id": "MAL-2026-6186",
  "modified": "2026-06-19T04:56:31Z",
  "published": "2026-06-19T04:56:31Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/electron-internal-utils/v/1.0.0"
    }
  ],
  "schema_version": "1.7.4",
  "summary": "Malicious code in electron-internal-utils (npm)"
}