Malicious code in zeal-util-hooks (npm)
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (2c9ed95500d2f1c637bcf47151a9220c0a81ee6cbd7a7aa4a8f66c74fed6e341) postinstall.js and index.js load canary.js, which POSTs a JSON payload to https://npm-canary.aveliscare.com/beacon at install time and on require. The payload contains os.hostname(), os.userInfo() username, cwd, process.platform, node version, npm user agent, parent package name/version, and a fixed allowlist of CI-identifier env vars (GITHUB_REPOSITORY, GITHUB_ACTOR, GITHUB_REF, GITHUB_RUN_ID, EAS/VERCEL/BUILDKITE identifiers). The endpoint is overridable via ZEAL_CANARY_URL but defaults to the hardcoded aveliscare.com host. The package advertises publisher Zeal (getzeal.io, github.com/zeal-io); the beacon destination aveliscare.com does not match that publisher. The collected fields are host/CI identifiers rather than credentials or filesystem contents, and no code execution, credential read, or persistent artifact is present. The install-time/require-time outbound network without opt-out breaks air-gapped installs, and the publisher/destination-domain mismatch is the shape typical of a dependency-confusion canary used to log where a placeholder name resolves.
MAL-2026-16541
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:MAL-2026-16541
zeal-util-hooks
Source reference: /affected/0/package/name
- Affected versions
- 0.0.0
Source reference:
/affected/0/versions - Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"package": {
"name": "zeal-util-hooks",
"purl": "pkg:npm/zeal-util-hooks",
"ecosystem": "npm"
},
"versions": [
"0.0.0"
],
"database_specific": {
"cwes": [
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
}
],
"source": "https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/zeal-util-hooks/MAL-2026-16541.json",
"indicators": {
"evidence_files": [
{
"path": "canary.js",
"tlsh": "acd1d86613f052762b8206b4591f00979736e027722aa170f5af92143f4a6bc87f3deb",
"sha256": "313f6afebeb44640d7df7a1995d0958bed918ecf2be8f171d4fbfe8dcab91f1d"
}
],
"package_integrity": [
{
"hashes": {
"sha1": "80cf18c7b742245379c6d2bf645fb9cc8ed80758",
"sha512_sri": "sha512-7eDJoy6Q/vblvlqgsv2+tECIgmge0lB0iSQyXRxim8s80e/NIxRCY+TEmDTHb+3gxQNosTu4Rk37lwD2cJHaxw=="
},
"filename": "zeal-util-hooks-0.0.0.tgz"
}
]
}
}
}
]Publisher severity
No explicit severity was provided.
- Event
- #33420 · Revision 1
- Added to Heist Feed
- Publisher date