Malicious code in sc-geeksquad-core (npm)

{
  "id": "f40374733427c89a702611cb5fbaad8d167dbe0e5c9c7d85cad5a9d299a90e04",
  "url": "https://osv.dev/vulnerability/MAL-2026-12435",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Malicious code in sc-geeksquad-core (npm)",
    "summary": "--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (2fd2458d8a5843f57187868a2c244a376dd3d2daef420d3c564c775ef6a2782a) sc-geeksquad-core@9999.0.0 declares a preinstall script `node callback.js` that runs automatically on `npm install`. The script collects the installer's hostname (`os.hostname()`), OS username (`os.userInfo().username`), current working directory (`process.cwd()`), configured npm registry (`npm_config_registry`), and a set of CI repository-slug environment variables (GITHUB_REPOSITORY, CI_PROJECT_PATH, BUILD_REPOSITORY_NAME, BITBUCKET_REPO_FULL_NAME, TRAVIS_REPO_SLUG, DRONE_REPO, BUILDKITE_PIPELINE_SLUG, CIRCLE_PROJECT_REPONAME, JOB_NAME), then sends them via HTTP GET to the hardcoded bare-IP endpoint `http://75.119.137.232:31337/depconfuse` as query parameters. The placeholder version `9999.0.0` combined with a generic scoped-sounding name is the canonical dependency-confusion reconnaissance shape: the package is published to public npm to intercept internal-package name resolution and beacon back which private-namespace builds are vulnerable to substitution. ## Source: ossf-package-analysis (2094a7f35be1c723c65b36c32884f2f0e99840ef0bc090a1fbcb1f5568b93ef2) The OpenSSF Package Analysis project identified 'sc-geeksquad-core' @ 99.9.1 (npm) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity.",
    "evidence": "osv:MAL-2026-12435",
    "products": [
      {
        "name": {
          "value": "sc-geeksquad-core",
          "evidence": "/affected/0/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": [
          {
            "value": "9999.0.0",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "99.9.1",
            "evidence": "/affected/0/versions"
          }
        ]
      }
    ],
    "severity": "unknown",
    "structured": {
      "id": "MAL-2026-12435",
      "aliases": [
        "MAL-2026-12435"
      ],
      "affected": [
        {
          "package": {
            "name": "sc-geeksquad-core",
            "purl": "pkg:npm/sc-geeksquad-core",
            "ecosystem": "npm"
          },
          "versions": [
            "9999.0.0",
            "99.9.1"
          ],
          "database_specific": {
            "cwes": [
              {
                "name": "Embedded Malicious Code",
                "cweId": "CWE-506",
                "description": "The product contains code that appears to be malicious in nature."
              },
              {
                "name": "Embedded Malicious Code",
                "cweId": "CWE-506",
                "description": "The product contains code that appears to be malicious in nature."
              }
            ],
            "source": "https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/sc-geeksquad-core/MAL-2026-12435.json",
            "indicators": {
              "evidence_files": [
                {
                  "path": "callback.js",
                  "tlsh": "2b117bb9c68c0c3409c21780796c6c5eb8fbd29233c294917f2d71d26bb22b046b75b9",
                  "sha256": "34b0456abf5f832f3a75addcda3dc765fe77a0929196a9d4e754393fa0fe0af5"
                }
              ],
              "package_integrity": [
                {
                  "hashes": {
                    "sha1": "2ba8e9b9308db1c083f88cf80285178f26e11490",
                    "sha512_sri": "sha512-upAoB93tviS4WRPiZVsgfejdOz9cBNsioQ2jEsYt3mWJaxmVOaxHCkxj7srGOJbYCiRBIDm1O7WxkJttGA/z/g=="
                  },
                  "filename": "sc-geeksquad-core-9999.0.0.tgz"
                }
              ]
            }
          }
        }
      ],
      "modified": "2026-10-25T15:30:04.666557682Z",
      "provider": "osv",
      "references": [
        "https://www.npmjs.com/package/sc-geeksquad-core/v/9999.0.0",
        "https://www.npmjs.com/package/sc-geeksquad-core/v/99.9.1"
      ],
      "provider_metadata": {
        "malicious-packages-origins": [
          {
            "id": "IN-MAL-2026-014891",
            "sha256": "2fd2458d8a5843f57187868a2c244a376dd3d2daef420d3c564c775ef6a2782a",
            "source": "amazon-inspector",
            "versions": [
              "9999.0.0"
            ],
            "import_time": "2026-08-05T13:08:53.322400325Z",
            "modified_time": "2026-08-05T13:07:29Z"
          },
          {
            "sha256": "2094a7f35be1c723c65b36c32884f2f0e99840ef0bc090a1fbcb1f5568b93ef2",
            "source": "ossf-package-analysis",
            "versions": [
              "99.9.1"
            ],
            "import_time": "2026-10-19T06:40:14.928246478Z",
            "modified_time": "2026-10-19T06:00:40Z"
          },
          {
            "id": "IN-MAL-2026-021689",
            "sha256": "b2df703a9fb6d992eadbdfe74aa62892edaf4b494f9a2f6c5fa51f0f1b634376",
            "source": "amazon-inspector",
            "versions": [
              "99.9.1"
            ],
            "import_time": "2026-10-25T15:15:14.012165243Z",
            "modified_time": "2026-10-25T15:05:13Z"
          }
        ]
      }
    },
    "related_cves": [],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "core-osv",
  "document_id": 445638,
  "published_at": "2026-08-05T13:07:29+00:00"
}