{
  "affected": [
    {
      "database_specific": {
        "cwes": [
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          }
        ],
        "indicators": {
          "evidence_files": [
            {
              "path": "index.js",
              "sha256": "dfbe84616bd17c7face74fa85caa3edf3c54163331e96e3009717837407aecb3",
              "tlsh": "a501f4f5517bf5740e6813e1d805ec0de763e121700595e05628c3ec6bd69f41670d9c"
            },
            {
              "path": "package.json",
              "sha256": "a183c41e4efaafed57b8f7d2422115b7a5c0d80d9d308730a97d1a38f78d4022",
              "tlsh": "2ed023305d14673368c8069d4c7b740675a14d1f010c341d4793542890ef97348ff31e"
            }
          ],
          "package_integrity": [
            {
              "filename": "titan-exchange-shared-permissions-99.9.9.tgz",
              "hashes": {
                "sha1": "f6a0bccc56cb491aef85168e2a4c4767227bc636",
                "sha512_sri": "sha512-psaLwuosIa0HlXl32dwmCp5DZcT8WDdctaRHmhEEstaxJ4oHANpMbBM8DRTe4XhxEtZ4uUSKQw5TXM+manI7lA=="
              }
            }
          ]
        }
      },
      "package": {
        "ecosystem": "npm",
        "name": "titan-exchange-shared-permissions"
      },
      "versions": [
        "99.9.9"
      ]
    }
  ],
  "credits": [
    {
      "contact": [
        "inspector-research@amazon.com"
      ],
      "name": "Amazon Inspector",
      "type": "FINDER"
    }
  ],
  "database_specific": {
    "malicious-packages-origins": [
      {
        "id": "IN-MAL-2026-017196",
        "import_time": "2026-08-08T00:53:09.991992004Z",
        "modified_time": "2026-08-08T00:52:01Z",
        "sha256": "248b317decf11a421474c727d9b8f543330eab17a65b31adf91f4083782025b6",
        "source": "amazon-inspector",
        "versions": [
          "99.9.9"
        ]
      }
    ]
  },
  "details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (248b317decf11a421474c727d9b8f543330eab17a65b31adf91f4083782025b6)\ntitan-exchange-shared-permissions@99.9.9 is a dependency-confusion reconnaissance package. package.json declares a postinstall script (`node index.js`) that runs automatically on `npm install`; index.js collects the installer\u0027s OS username (os.userInfo().username), hostname (os.hostname()), current working directory, and non-internal IPv4 address (from os.networkInterfaces()) and POSTs them as JSON via https.request to the hardcoded collector https://webhook.site/452b7e38-183d-4652-847d-0f2fa05b9389. The package name is styled to resemble a private internal scope, is published at version 99.9.9, and ships with empty description/author/license and no other functionality \u2014 the canonical namesquat/dependency-confusion probe shape used to identify build systems that resolve a private name to the public registry.\n",
  "id": "MAL-2026-13664",
  "modified": "2026-08-08T00:52:01Z",
  "published": "2026-08-08T00:52:01Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/titan-exchange-shared-permissions/v/99.9.9"
    }
  ],
  "schema_version": "1.7.4",
  "summary": "Malicious code in titan-exchange-shared-permissions (npm)"
}