{
  "affected": [
    {
      "database_specific": {
        "cwes": [
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          }
        ],
        "indicators": {
          "evidence_files": [
            {
              "path": "index.js",
              "sha256": "40f9a81d39fc4fc5a1895aa2f82b01fab53b5eae8b61c80885affddb485db439",
              "tlsh": "28f164d991372661cfb233b85a03100dfbdad12339028651b6ec46486f7b52865e2eee"
            }
          ],
          "package_integrity": [
            {
              "filename": "ts-linter-builders-1.0.4.tgz",
              "hashes": {
                "sha1": "b2b1e7e742e14de6f25aaed7e0eb43d651f949e3",
                "sha512_sri": "sha512-pD2FpJNDdBZ4OTc6yapxR4iYqBBkzlOCfqvjlBLqu36W7LZQuZZakGkxcK6084DFlIGC2Si82QT4tvAZX0a//g=="
              }
            }
          ]
        }
      },
      "package": {
        "ecosystem": "npm",
        "name": "ts-linter-builders"
      },
      "versions": [
        "1.0.4"
      ]
    }
  ],
  "credits": [
    {
      "contact": [
        "inspector-research@amazon.com"
      ],
      "name": "Amazon Inspector",
      "type": "FINDER"
    }
  ],
  "database_specific": {
    "malicious-packages-origins": [
      {
        "id": "IN-MAL-2026-007045",
        "import_time": "2026-06-19T05:16:48.600745745Z",
        "modified_time": "2026-06-19T04:30:48Z",
        "sha256": "a22153f1e71ba9fb51ce22d5fc57180ce4d8998995fbc4bd554d6dd532c195b6",
        "source": "amazon-inspector",
        "versions": [
          "1.0.4"
        ]
      }
    ]
  },
  "details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (a22153f1e71ba9fb51ce22d5fc57180ce4d8998995fbc4bd554d6dd532c195b6)\nindex.js imports child_process and contains a hardcoded outbound POST to https://tg-wallet-manager.vercel.app, with additional fetch() calls to the same destination. The code reads environment data and host identifiers and ships them to this attacker-controlled endpoint. The package name advertises a TypeScript linter helper, but the embedded behavior is unrelated to linting and matches the shape of a credential/host-info beacon. The hardcoded third-party Vercel-hosted endpoint, combined with environment reads and child_process import, constitutes an installer-side exfiltration / RCE staging surface with no legitimate purpose for a \u0027linter builder\u0027 package.\n",
  "id": "MAL-2026-6195",
  "modified": "2026-06-19T04:30:48Z",
  "published": "2026-06-19T04:30:48Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/ts-linter-builders/v/1.0.4"
    }
  ],
  "schema_version": "1.7.4",
  "summary": "Malicious code in ts-linter-builders (npm)"
}