{
  "affected": [
    {
      "database_specific": {
        "cwes": [
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          }
        ]
      },
      "package": {
        "ecosystem": "npm",
        "name": "request-tracking-sqlite"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "SEMVER"
        }
      ],
      "versions": [
        "1.0.0",
        "2.0.0"
      ]
    }
  ],
  "credits": [
    {
      "contact": [
        "https://westbayberry.com",
        "https://github.com/ComCat1"
      ],
      "name": "WestBayBerry / dependency-guardian",
      "type": "FINDER"
    }
  ],
  "database_specific": {
    "iocs": {
      "domains": [
        "surrprisingcoompanny.lol",
        "barbellmate.xyz"
      ]
    },
    "malicious-packages-origins": null
  },
  "details": "The npm package `request-tracking-sqlite` (published by npm user `sproger`, slavatopbuyer@gmail.com) is a deceptive React Native component and part of a coordinated 37-package campaign across two attacker-controlled domains (surrprisingcoompanny.lol and barbellmate.xyz). On component mount it registers `appsFlyer.onInstallConversionData` and exfiltrates the app\u0027s install/conversion attribution data via `axios.post(\"https://barbellmate.xyz\", data)`, fetches a remote-config URL, and renders it full-screen in a `react-native-webview` that is hidden (display:\u0027none\u0027) unless the server returns a valid URL \u2014 i.e. App Store review-evasion / attribution-laundering (\u0027cloaking\u0027). The package name is a decoy unrelated to its actual function, and the real logic is concealed behind junk \u0027calculator\u0027 functions with Ukrainian-language comments. Indicators of compromise: C2 surrprisingcoompanny.lol, barbellmate.xyz; npm author `sproger`. Both C2 domains are currently unregistered (dangling-C2 takeover risk for any app still shipping these packages). In this package the payload is obfuscated with obfuscator.io (RC4 string-array); the C2 `barbellmate.xyz` and the exfiltration logic are recoverable by decoding the string array (recovered fragments include \u0027https://barbellmate.xyz\u0027 and \u0027Error during fetchData\u0027).",
  "id": "MAL-2026-6176",
  "modified": "2026-06-17T12:00:00Z",
  "published": "2026-06-17T12:00:00Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/request-tracking-sqlite"
    }
  ],
  "schema_version": "1.7.4",
  "summary": "Malicious code in request-tracking-sqlite (npm)"
}