{
  "affected": [
    {
      "database_specific": {
        "cwes": [
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          }
        ],
        "indicators": {
          "evidence_files": [
            {
              "path": "index.js",
              "sha256": "4e83a9038c807574bf3ca7daf2fc44d5fb4b394df7fa8f897e599cbbaa6432fa",
              "tlsh": "6411eff599f386a01dbb61c06586580590aed503bd0df8f87e4d43e01f854b545a16b4"
            },
            {
              "path": "package.json",
              "sha256": "573b7ddcc637479325755fd45b2272015c3cfd7022855ebf0756fee552c42763",
              "tlsh": "14e0c2285961993315c55252092d9043b360de5f00487c0c53cb582c82de5b358fe34e"
            }
          ],
          "package_integrity": [
            {
              "filename": "orca-website-1.0.0.tgz",
              "hashes": {
                "sha1": "4c90aceabda035e5a59e095a7368783d7d736e5c",
                "sha512_sri": "sha512-BAcyThzeW8b01VCMymIsKLbEEcomb73k5aFeiGvSDPDCsdF4+PaZQklN4NIkKGrqpcbaPUyn2Ceia/BzedTRXg=="
              }
            }
          ]
        }
      },
      "package": {
        "ecosystem": "npm",
        "name": "orca-website"
      },
      "versions": [
        "1.0.0"
      ]
    }
  ],
  "credits": [
    {
      "contact": [
        "actran@amazon.com"
      ],
      "name": "Amazon Inspector",
      "type": "FINDER"
    }
  ],
  "database_specific": {
    "malicious-packages-origins": [
      {
        "id": "IN-MAL-2026-004249",
        "import_time": "2026-05-26T05:52:14.069946701Z",
        "modified_time": "2026-05-22T19:36:29Z",
        "sha256": "c52f7fe46d56cb45880942f5266494a2654d9d330914a6c3c99f02045eacd1dc",
        "source": "amazon-inspector",
        "versions": [
          "1.0.0"
        ]
      }
    ]
  },
  "details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (c52f7fe46d56cb45880942f5266494a2654d9d330914a6c3c99f02045eacd1dc)\nOn require()/import, index.js collects host identifiers (os.hostname(), os.userInfo().username, os.platform(), os.arch(), process.cwd(), process.pid, timestamp) and sends them as URL query parameters via HTTPS GET to a hardcoded Project Discovery Interactsh out-of-band collaborator at vwfmeddcdgidvdwpkigkg0l8us5vf3wtx.oast.fun. The package\u0027s stated name (\u0027orca-website\u0027) has no relationship to host telemetry; package.json carries empty author, description, and keywords. Any consumer that imports this package unconditionally leaks installer-side host identification to an attacker-controlled OOB domain typically used for reconnaissance / dependency-confusion probing.\n",
  "id": "MAL-2026-4632",
  "modified": "2026-05-22T19:36:29Z",
  "published": "2026-05-22T19:36:29Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/orca-website/v/1.0.0"
    }
  ],
  "schema_version": "1.7.4",
  "summary": "Malicious code in orca-website (npm)"
}