{
  "affected": [
    {
      "database_specific": {
        "cwes": [
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          }
        ],
        "indicators": {
          "evidence_files": [
            {
              "path": "index.js",
              "sha256": "5c332aea70085f86d39ea772daacebddd49e4cafd182b3713582ddc0d361198d",
              "tlsh": "dc411fbb2330049416b3616669379f1bf4b32b3b94e18992f8bacb64d5a3a801471b4d"
            }
          ],
          "package_integrity": [
            {
              "filename": "your-unique-package-name1-1.0.0.tgz",
              "hashes": {
                "sha1": "bcc7580ab94e7570290df4e578614426b6ccbaa1",
                "sha512_sri": "sha512-HUHnRypedL351NSuz0qg6hvWwtjdWV7wgwpXP23/Wgef2MkZt2FoRw5v/xlSMIDkfiG70Y0a7rjMyCopZKZNrA=="
              }
            }
          ]
        }
      },
      "package": {
        "ecosystem": "npm",
        "name": "your-unique-package-name1"
      },
      "versions": [
        "1.0.0"
      ]
    }
  ],
  "credits": [
    {
      "contact": [
        "actran@amazon.com"
      ],
      "name": "Amazon Inspector",
      "type": "FINDER"
    }
  ],
  "database_specific": {
    "malicious-packages-origins": [
      {
        "id": "IN-MAL-2026-004569",
        "import_time": "2026-05-26T05:52:51.563611848Z",
        "modified_time": "2026-05-25T02:44:28Z",
        "sha256": "8a82d9cce1cd5cae0e9bae039dc08eccc18ec4494b182d11ab35c25ac4496d34",
        "source": "amazon-inspector",
        "versions": [
          "1.0.0"
        ]
      }
    ]
  },
  "details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (8a82d9cce1cd5cae0e9bae039dc08eccc18ec4494b182d11ab35c25ac4496d34)\nOn import in a browser context, index.js creates a hidden iframe pointing at https://www.pendo.io/?builder.frameEditing=true and postMessages a \u0027builder.patchUpdates\u0027 payload to 20 hardcoded builder-\u003cuuid\u003e resources, replacing their \u0027/bindings/show\u0027 binding with an injected script. The injected script calls fetch(\u0027https://novus-api.pendo.io/pendo/app\u0027, {credentials:\u0027include\u0027}), base64-encodes the authenticated response, and beacons it in 2000-byte chunks to https://webhook.site/ea1a1f2d-46e2-463a-a1c1-48c53846dff4 via new Image().src. Any application that bundles this package will silently exfiltrate its end users\u0027 authenticated Pendo session data to an anonymous attacker-controlled webhook. The package self-describes as \u0027Security research PoC\u0027 but the destination is not a researcher-owned domain and the targeting (hardcoded victim UUIDs, credentials-included fetch) is consistent with a live attack rather than a contained PoC.\n",
  "id": "MAL-2026-4737",
  "modified": "2026-05-25T02:44:28Z",
  "published": "2026-05-25T02:44:28Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/your-unique-package-name1/v/1.0.0"
    }
  ],
  "schema_version": "1.7.4",
  "summary": "Malicious code in your-unique-package-name1 (npm)"
}