Skip to content
Heist/ feed
Unrated

Malicious code in git-en-boite-logging (npm)

Type: advisorySource: OSV1 source record

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (f6ebee9f4428d7f14f6f941438064715c8bece34c5fe6bfedf32bbd8cba226c0) package.json declares a preinstall lifecycle hook that runs `wget` to a hardcoded webhook.site collector URL (https://webhook.site/3fcfa5af-1b4e-4556-9d48-26190d02795f/), passing `$(whoami)`, `$(hostname)`, and `$(pwd)` as query parameters. On `npm install`, npm invokes the preinstall script automatically, so the installer's OS username, host name, and current working directory are transmitted to an anonymous third-party webhook collector without any user action. This is the canonical dependency-confusion / reconnaissance beacon shape: an otherwise-empty package whose only on-install effect is to phone home installer identity to an attacker-chosen endpoint, typically used to confirm ingress into a target's internal build environment before staging a follow-on payload.

Announced Source revision 1
Original source ↗

MAL-2026-17214

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:MAL-2026-17214

git-en-boite-logging

Source reference: /affected/0/package/name

Affected versions
0.0.0

Source reference: /affected/0/versions

Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "package": {
      "name": "git-en-boite-logging",
      "purl": "pkg:npm/git-en-boite-logging",
      "ecosystem": "npm"
    },
    "versions": [
      "0.0.0"
    ],
    "database_specific": {
      "cwes": [
        {
          "name": "Embedded Malicious Code",
          "cweId": "CWE-506",
          "description": "The product contains code that appears to be malicious in nature."
        }
      ],
      "source": "https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/git-en-boite-logging/MAL-2026-17214.json",
      "indicators": {
        "evidence_files": [
          {
            "path": "package.json",
            "tlsh": "5f01d334f620b92307c597a15525461bba32fba7da1a6c0deba71259531d8ea0078a18",
            "sha256": "eeeb7167a98450e8be74ff678e8b1e72ba1c68ed75fd157f1352d5e90dfdfe30"
          }
        ],
        "package_integrity": [
          {
            "hashes": {
              "sha1": "9b6320e561bb6b58d363bface8b6c6f90fea6c28",
              "sha512_sri": "sha512-NpfFTMEfKE1HF+2F7ZE66DoiQj017DTFOa4a1glV0xG0lthw4cwFH6PnFVjERMxGYlnyeUHVEk8q+VxobgInkQ=="
            },
            "filename": "git-en-boite-logging-0.0.0.tgz"
          }
        ]
      }
    }
  }
]

Publisher severity

No explicit severity was provided.

Event
#22491 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement