Malicious code in shoplist-app (npm)
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (fdceadb01f08162934382b121e813236b86adc0d4d74b7b2f062c78e529c34f6) shoplist-app@99.99.99 is a dependency-confusion / typosquat beacon. preinstall.js is wired into every lifecycle hook (preinstall, install, postinstall, prepare, prepublish) and issues an HTTPS GET to the hardcoded endpoint https://eo8f3m3ho26a0nm.m.pipedream.net/, transmitting the installer's machine hostname via os.hostname() (smuggled into a `host` HTTP header) together with package identity in the query string. index.js — the package `main` — independently fires a second HTTPS GET to the same Pipedream collector at require/import time, carrying os.platform() and a `trigger=runtime` marker. The package ships no functional code beyond these beacons; its version (99.99.99) and description ("test") are consistent with a name-squat probe designed to identify which internal build hosts resolve the name shoplist-app. The exfiltrated data (hostname, OS platform, package-name confirmation) gives the operator of the Pipedream endpoint a map of environments where a shoplist-app dependency reference successfully resolves to this public package — the standard reconnaissance stage of a dependency-confusion attack.
MAL-2026-17185
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:MAL-2026-17185
shoplist-app
Source reference: /affected/0/package/name
- Affected versions
- 993.99.99
Source reference:
/affected/0/versions99.99.99Source reference:
/affected/0/versions - Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"package": {
"name": "shoplist-app",
"purl": "pkg:npm/shoplist-app",
"ecosystem": "npm"
},
"versions": [
"993.99.99",
"99.99.99"
],
"database_specific": {
"cwes": [
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
},
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
}
],
"source": "https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/shoplist-app/MAL-2026-17185.json",
"indicators": {
"evidence_files": [
{
"path": "preinstall.js",
"tlsh": "a421ed6f29f5013136d7a9ee150b4d45b393c253535aced4fa8e03600f4687846f32e1",
"sha256": "9ef16bffed95a49676ec4c882388450a002d8e56ae8ac6a794ff07cb1ae56042"
},
{
"path": "index.js",
"tlsh": "a401f1f706f4623012d489d5f4139786b097d213c34686e0e2de13e01f02ca552b35f0",
"sha256": "fbdf52c9f9585e0aaa1477fbbd2f0e3e9aa99064935f50f72b570e5a62262075"
}
],
"package_integrity": [
{
"hashes": {
"sha1": "3d841cdd7e119df37b6c79c5d9b5b91f1c8e7bde",
"sha512_sri": "sha512-JVNJO55dfEY+Oh1Bp7aKv0bhAUkvwf+WY26ODs4HcRBwgdnzMyzQSyEmvtYPX23S1jE1FeX6VJdtnR5tDNLCMA=="
},
"filename": "shoplist-app-993.99.99.tgz"
}
]
}
}
}
]Publisher severity
No explicit severity was provided.
- Event
- #15301 · Revision 1
- Added to Heist Feed
- Publisher date