{
  "affected": [
    {
      "database_specific": {
        "cwes": [
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          }
        ],
        "indicators": {
          "evidence_files": [
            {
              "path": "dist/typecheck.js",
              "sha256": "cafebcfe50f4d6ed218f4525f44b81654bf2df4ebb06918984b4257940d4fd5b",
              "tlsh": "573633fb10d3b2ea31a258191ab675a067017c362d8e6110be4fd697d37dcdae16230f"
            },
            {
              "path": "dist/typecheck.js.map",
              "sha256": "d4f0edd5346dc9df95dc008b95c1bcb0ca83aaa92ee3dbc9a46e83a376605ede",
              "tlsh": "2a5133036c76c930b1212fe96d9d45416718b00c22d8da24bcac91213ba7f5ff9fb4a5"
            }
          ],
          "package_integrity": [
            {
              "filename": "python-utils-0.2.26.tgz",
              "hashes": {
                "sha1": "22e94f6a4997a649f904de4e54772bf6349748d2",
                "sha512_sri": "sha512-hXunJn8yfGgunf/SAgsm1RlfHE++k7XbiuaA9WHMcncmesxs5mcPCDknjBvYQrUyS9lFRjSlCmncdjjTljhYug=="
              }
            }
          ]
        }
      },
      "package": {
        "ecosystem": "npm",
        "name": "python-utils"
      },
      "versions": [
        "0.2.26"
      ]
    }
  ],
  "credits": [
    {
      "contact": [
        "actran@amazon.com"
      ],
      "name": "Amazon Inspector",
      "type": "FINDER"
    }
  ],
  "database_specific": {
    "malicious-packages-origins": [
      {
        "id": "IN-MAL-2026-003426",
        "import_time": "2026-05-26T05:50:37.227323345Z",
        "modified_time": "2026-05-20T02:36:56Z",
        "sha256": "5b94c01fae325c5f5e92abd5da03527c54e22bb48202b1dc8b3e2c64947753b2",
        "source": "amazon-inspector",
        "versions": [
          "0.2.26"
        ]
      }
    ]
  },
  "details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (5b94c01fae325c5f5e92abd5da03527c54e22bb48202b1dc8b3e2c64947753b2)\npackage.json declares \"preinstall\": \"./dist/typecheck.js\". The referenced file is not JavaScript \u2014 it is a 5,224,556-byte Linux x86 ELF executable (containing `__libc_start_main`, `/lib64`, and `nux-x86-` interpreter strings) with the literal endpoint `207.90.194.2:443` baked into it. The native binary is concealed behind forged TypeScript build metadata: a sibling `dist/typecheck.d.ts` declares a `getParser(): Promise\u003cParser\u003e` API for tree-sitter Python, and `dist/typecheck.js.map` is a reused copy of `parser.js.map` (its `\"file\"` field is `\"parser.js\"`), making the dropper look like ordinary tsdown output to a casual reviewer. On `npm install` on any Linux x86 host, the ELF runs automatically as the installer\u0027s user, calling out to the hardcoded IP:port. The package\u0027s stated purpose (a Python utility / tree-sitter parser wrapper) has no legitimate need to ship or execute a native binary at install time, and no pure-JS code path actually consumes `getParser`.\n",
  "id": "MAL-2026-4652",
  "modified": "2026-05-20T02:36:56Z",
  "published": "2026-05-20T02:36:56Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/python-utils/v/0.2.26"
    }
  ],
  "schema_version": "1.7.4",
  "summary": "Malicious code in python-utils (npm)"
}