Skip to content
Heist/ feed
Unrated

Malicious code in shoplist-app (npm)

Type: advisorySource: OSV1 source record

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (fdceadb01f08162934382b121e813236b86adc0d4d74b7b2f062c78e529c34f6) shoplist-app@99.99.99 is a dependency-confusion / typosquat beacon. preinstall.js is wired into every lifecycle hook (preinstall, install, postinstall, prepare, prepublish) and issues an HTTPS GET to the hardcoded endpoint https://eo8f3m3ho26a0nm.m.pipedream.net/, transmitting the installer's machine hostname via os.hostname() (smuggled into a `host` HTTP header) together with package identity in the query string. index.js — the package `main` — independently fires a second HTTPS GET to the same Pipedream collector at require/import time, carrying os.platform() and a `trigger=runtime` marker. The package ships no functional code beyond these beacons; its version (99.99.99) and description ("test") are consistent with a name-squat probe designed to identify which internal build hosts resolve the name shoplist-app. The exfiltrated data (hostname, OS platform, package-name confirmation) gives the operator of the Pipedream endpoint a map of environments where a shoplist-app dependency reference successfully resolves to this public package — the standard reconnaissance stage of a dependency-confusion attack.

Announced Source revision 1
Original source ↗

MAL-2026-17185

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:MAL-2026-17185

shoplist-app

Source reference: /affected/0/package/name

Affected versions
993.99.99

Source reference: /affected/0/versions

99.99.99

Source reference: /affected/0/versions

Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "package": {
      "name": "shoplist-app",
      "purl": "pkg:npm/shoplist-app",
      "ecosystem": "npm"
    },
    "versions": [
      "993.99.99",
      "99.99.99"
    ],
    "database_specific": {
      "cwes": [
        {
          "name": "Embedded Malicious Code",
          "cweId": "CWE-506",
          "description": "The product contains code that appears to be malicious in nature."
        },
        {
          "name": "Embedded Malicious Code",
          "cweId": "CWE-506",
          "description": "The product contains code that appears to be malicious in nature."
        }
      ],
      "source": "https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/shoplist-app/MAL-2026-17185.json",
      "indicators": {
        "evidence_files": [
          {
            "path": "preinstall.js",
            "tlsh": "a421ed6f29f5013136d7a9ee150b4d45b393c253535aced4fa8e03600f4687846f32e1",
            "sha256": "9ef16bffed95a49676ec4c882388450a002d8e56ae8ac6a794ff07cb1ae56042"
          },
          {
            "path": "index.js",
            "tlsh": "a401f1f706f4623012d489d5f4139786b097d213c34686e0e2de13e01f02ca552b35f0",
            "sha256": "fbdf52c9f9585e0aaa1477fbbd2f0e3e9aa99064935f50f72b570e5a62262075"
          }
        ],
        "package_integrity": [
          {
            "hashes": {
              "sha1": "3d841cdd7e119df37b6c79c5d9b5b91f1c8e7bde",
              "sha512_sri": "sha512-JVNJO55dfEY+Oh1Bp7aKv0bhAUkvwf+WY26ODs4HcRBwgdnzMyzQSyEmvtYPX23S1jE1FeX6VJdtnR5tDNLCMA=="
            },
            "filename": "shoplist-app-993.99.99.tgz"
          }
        ]
      }
    }
  }
]

Publisher severity

No explicit severity was provided.

Event
#15301 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement