{
  "affected": [
    {
      "database_specific": {
        "cwes": [
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          }
        ],
        "indicators": {
          "evidence_files": [
            {
              "path": "postinstall.js",
              "sha256": "260c98caffc90f037cb4f3f642c90861aa69253bc2e45f87ec604225272c2069",
              "tlsh": "23017bf491b396501ff5a1c4a484dc07516bd201760778b0b6d44399af94af818b18e5"
            },
            {
              "path": "package.json",
              "sha256": "5d4d9f8959e93b4d9f9b1164394e61352588d5e6396c79efda7f603fe7139062",
              "tlsh": "ccd012701c50766378c90a664a33554f55f14d2e6105b41c17d760b443cb6bbd8ab32e"
            }
          ],
          "package_integrity": [
            {
              "filename": "front-components-1.0.5.tgz",
              "hashes": {
                "sha1": "56ae673295a155f84c233bef4d3d2dbed8ea5c92",
                "sha512_sri": "sha512-SsCkBlqhf//cuarQ9eoIhnYr5HAfqMC7eA+LoTTbcfS5vIgR72mU3SXKGTrywvDPYMMXv5qUrRQxkNU2bAEvPg=="
              }
            }
          ]
        }
      },
      "package": {
        "ecosystem": "npm",
        "name": "@catamania/front-components"
      },
      "versions": [
        "1.0.5"
      ]
    }
  ],
  "credits": [
    {
      "contact": [
        "inspector-research@amazon.com"
      ],
      "name": "Amazon Inspector",
      "type": "FINDER"
    }
  ],
  "database_specific": {
    "malicious-packages-origins": [
      {
        "id": "IN-MAL-2026-017120",
        "import_time": "2026-08-07T17:23:16.832280946Z",
        "modified_time": "2026-08-07T17:07:40Z",
        "sha256": "49b66b93df02350bdf848ac2cff8c6a563ac36c1828480891381875453be67f5",
        "source": "amazon-inspector",
        "versions": [
          "1.0.5"
        ]
      }
    ]
  },
  "details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (49b66b93df02350bdf848ac2cff8c6a563ac36c1828480891381875453be67f5)\nThe package\u0027s postinstall.js runs automatically on npm install and collects host reconnaissance data \u2014 os.hostname(), os.userInfo() username, process.cwd(), and the list of environment variable names from process.env \u2014 then POSTs the JSON payload via https.request to a hardcoded webhook.site capture URL (webhook.site/4b333dc6-9783-4f6b-82fa-db9795caa938). Environment variable values are masked but key names and host identifiers still leave the installer\u0027s machine on every install. The package\u0027s index.js contains only a trivial 5-line Vue button component, which does not correspond to the install-time beaconing behavior; the shape is consistent with a scoped dependency-confusion or reconnaissance probe measuring which internal build hosts resolve the @catamania scope to the public registry.\n",
  "id": "MAL-2026-13620",
  "modified": "2026-08-07T17:07:40Z",
  "published": "2026-08-07T17:07:40Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/@catamania/front-components/v/1.0.5"
    }
  ],
  "schema_version": "1.7.4",
  "summary": "Malicious code in @catamania/front-components (npm)"
}