{
  "affected": [
    {
      "database_specific": {
        "cwes": [
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          }
        ],
        "indicators": {
          "evidence_files": [
            {
              "path": "index.js",
              "sha256": "addbcd00de83cb84cce6655375cce010012e1d9724207692c05a7b5699034e7d",
              "tlsh": "94e166aa01162136d6f1e3f8eb560416f79ed2137602c74276ac4ac92f77428e1d2fec"
            },
            {
              "path": "package.json",
              "sha256": "cdea78bc905183eb899ea3a9363778b427c7cc704c2f1fe88fa983cf538a04b9",
              "tlsh": "2fe0c2328e69a93708f8a6a56e681b03f1618f2f12748c0f71f7551c97e31a304a8f4d"
            }
          ],
          "package_integrity": [
            {
              "filename": "ts-bn-lint-helper-3.1.19.tgz",
              "hashes": {
                "sha1": "5575cbd59199abe6385ec39e64e82c53ed1e497d",
                "sha512_sri": "sha512-tVD1gUs5BvFLxhrm6JjlchfG2r0xESuFdGF6r4gcn7e3ZhfHafIDWnTED8YROBGyVeGC1QeV/MCurgi+n/zeog=="
              }
            }
          ]
        }
      },
      "package": {
        "ecosystem": "npm",
        "name": "ts-bn-lint-helper"
      },
      "versions": [
        "3.1.19"
      ]
    }
  ],
  "credits": [
    {
      "contact": [
        "inspector-research@amazon.com"
      ],
      "name": "Amazon Inspector",
      "type": "FINDER"
    }
  ],
  "database_specific": {
    "malicious-packages-origins": [
      {
        "id": "IN-MAL-2026-007264",
        "import_time": "2026-06-23T16:54:12.807378937Z",
        "modified_time": "2026-06-23T16:11:21Z",
        "sha256": "8847a06a4d25b751ec7d33732a23324a42d7b2775ce441811623500b7b60f267",
        "source": "amazon-inspector",
        "versions": [
          "3.1.19"
        ]
      }
    ]
  },
  "details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (8847a06a4d25b751ec7d33732a23324a42d7b2775ce441811623500b7b60f267)\nPackage masquerades as a TypeScript lint helper but ships a credential-harvesting payload in index.js. The exported from_str() recursively walks process.cwd() and uploads every file matching id.json, config.toml, Config.toml, config.json, env, and.env to https://data-stream.space/api/v1 via axios POST (index.js:178). It additionally harvests shell history from ~/.bash_history, ~/.zsh_history, fish history, ~/.sh_history, and PowerShell PSReadLine ConsoleHost_history.txt, falling back to spawning `bash -c history` and `zsh -c \u0027fc -l -1000\u0027` via execSync (index.js:101, 117, 128-152). The exfiltration URL and target file patterns are base64-encoded module-level constants decoded through a `decodeStr` helper (index.js:8-30) to evade naive string scanners. Username and local IP are prepended to each upload. The bundled test.js auto-invokes from_str() under `npm test`. Package metadata is hollow (empty description, author, keywords) and the name mimics legitimate TypeScript lint tooling. Any consumer that requires this package and calls from_str(), or runs npm test, ships their working-directory secrets and shell history to the attacker-controlled host.\n",
  "id": "MAL-2026-6318",
  "modified": "2026-06-23T16:11:21Z",
  "published": "2026-06-23T16:11:21Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/ts-bn-lint-helper/v/3.1.19"
    }
  ],
  "schema_version": "1.7.4",
  "summary": "Malicious code in ts-bn-lint-helper (npm)"
}