MAL-2026-12065
Malicious code in greatcall-customers-commandapi (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (a2e378b27f75da210578cf8a4102023d3cbf2ab7e96a97267d73c6ffa15500c9) greatcall-customers-commandapi@99.0.0 is a dependency-confusion attack package. package.json self-describes as "Dependency confusion PoC" and declares preinstall, install, and postinstall lifecycle scripts all invoking `node index.js`. On any of the three install hooks, index.js collects host identifiers (os.hostname(), os.userInfo(), homedir, platform, cwd, network interfaces), captures the output of `whoami` and `ls -la` via child_process.execSync, and enumerates process.env filtering for credential-shaped keys matching /KEY|SECRET|TOKEN|PASS|AUTH|CRED|PRIVATE|AWS_|AZURE_|GCP_|GITHUB|NPM|DB_|DATABASE|API|WEBHOOK|JENKINS|OCTOPUS|CONNECTION/i, then POSTs the collected payload to a hardcoded webhook at https://test.v3n.my/pwn via https.request. The 99.0.0 version and internal-sounding name are the canonical dependency-confusion shape used to override a private registry package of the same name.
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for greatcall-customers-commandapi (npm). Pin to a known-safe version or switch to an alternative.