{
  "affected": [
    {
      "database_specific": {
        "cwes": [
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          },
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          },
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          }
        ],
        "indicators": {
          "evidence_files": [
            {
              "path": "prebuilds/linux-x64/addon.node",
              "sha256": "d1ecb9d24c13b9a47b3fc19036fee676e13c65af1df61b8d61bd9ec8aadeb906",
              "tlsh": "c272761bb761c93bc4e853389497466572f2a470777243232f00a17a2cd37889ebbd5a"
            },
            {
              "path": "package.json",
              "sha256": "86fc6110d043ca50d2fee85029e57fb3e90d6d4d34388d0c53e5a621ece55f01",
              "tlsh": "b2d012140e33963378c04ba55d275a0e65720d6f4004b41c13e3215982dabfb4cbb31e"
            }
          ],
          "package_integrity": [
            {
              "filename": "test-account-portal-fe-100.100.100.tgz",
              "hashes": {
                "sha1": "0841039ad4b8e151fec618983a25fd7758e59af1",
                "sha512_sri": "sha512-Mml9T4BaC/IR7y0V675pQLyh70mkuEiDSCjeHtDNZmMP/eNTFYzf9AyW+/VUaFwTPhOA+w/d1h4vcjUyQP2ijA=="
              }
            }
          ]
        }
      },
      "package": {
        "ecosystem": "npm",
        "name": "test-account-portal-fe"
      },
      "versions": [
        "100.100.102",
        "100.100.100",
        "100.100.101"
      ]
    }
  ],
  "credits": [
    {
      "contact": [
        "inspector-research@amazon.com"
      ],
      "name": "Amazon Inspector",
      "type": "FINDER"
    },
    {
      "contact": [
        "https://github.com/ossf/package-analysis",
        "https://openssf.slack.com/channels/package_analysis"
      ],
      "name": "OpenSSF: Package Analysis",
      "type": "FINDER"
    }
  ],
  "database_specific": {
    "malicious-packages-origins": [
      {
        "import_time": "2026-10-09T19:15:19.362264369Z",
        "modified_time": "2026-10-09T19:10:36Z",
        "sha256": "5dd02103458df4faa2c37da43a76a468a0a22d591fb77c5d756e7d7496d68907",
        "source": "ossf-package-analysis",
        "versions": [
          "100.100.102"
        ]
      },
      {
        "id": "IN-MAL-2026-021423",
        "import_time": "2026-10-11T14:18:04.381155092Z",
        "modified_time": "2026-10-11T13:57:11Z",
        "sha256": "63911c5f393d2276fffe11b7d465b04704722dc852a79fbfbd63b5f8dbd812b8",
        "source": "amazon-inspector",
        "versions": [
          "100.100.100"
        ]
      },
      {
        "id": "IN-MAL-2026-021378",
        "import_time": "2026-10-11T14:18:00.739376595Z",
        "modified_time": "2026-10-11T13:50:23Z",
        "sha256": "d9191f0c04c63fc8aa02af2a97681b15cfd241ead915ee30f0b79baa0c4e0200",
        "source": "amazon-inspector",
        "versions": [
          "100.100.102"
        ]
      },
      {
        "id": "IN-MAL-2026-021469",
        "import_time": "2026-10-13T07:32:01.72436852Z",
        "modified_time": "2026-10-13T07:08:59Z",
        "sha256": "0f7b6c3f1f6f212d75283827455926079593132bbd819dec884caed3e3b745ca",
        "source": "amazon-inspector",
        "versions": [
          "100.100.101"
        ]
      }
    ]
  },
  "details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (0f7b6c3f1f6f212d75283827455926079593132bbd819dec884caed3e3b745ca)\nnpm package test-account-portal-fe@100.100.101 ships only a Linux x64 native addon at prebuilds/linux-x64/addon.node and loads it unconditionally from index.js via require(\u0027./prebuilds/linux-x64/addon\u0027). No C/C++ source, binding.gyp, prebuild URL, or checksum accompanies the binary, and the stated purpose (\"Frontend utilities\") has no need for a native addon. On NAPI module init the addon forks and opens a socket to the hardcoded bare IP 64.181.165.115, issuing POST /dc HTTP/1.0 with a body of the form h=\u003chostname\u003e\u0026u=\u003cunix-user\u003e\u0026p=\u003cnpm_package_name\u003e\u0026r=\u003cnpm_config_registry\u003e, exfiltrating the installer\u0027s host identity, local username, consuming package name, and configured npm registry URL. ELF strings and imports (socket/connect/send/gethostname/getpwuid/getenv, symbol try_connect) corroborate the beacon. The package name and implausibly high version (100.100.101) alongside a placeholder description are consistent with a dependency-confusion probe against an internal account-portal-fe package: exfiltrating npm_config_registry is precisely how such a probe confirms resolution against a private registry. Installing or requiring this package automatically leaks installer identity and internal registry configuration to attacker-controlled infrastructure.\n\n## Source: ossf-package-analysis (5dd02103458df4faa2c37da43a76a468a0a22d591fb77c5d756e7d7496d68907)\nThe OpenSSF Package Analysis project identified \u0027test-account-portal-fe\u0027 @ 100.100.102 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package communicates with a domain associated with malicious activity.\n",
  "id": "MAL-2026-17748",
  "modified": "2026-10-13T07:34:10.911152470Z",
  "published": "2026-10-09T19:10:36Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/test-account-portal-fe/v/100.100.100"
    },
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/test-account-portal-fe/v/100.100.102"
    },
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/test-account-portal-fe/v/100.100.101"
    }
  ],
  "schema_version": "1.7.4",
  "summary": "Malicious code in test-account-portal-fe (npm)"
}