MAL-2026-13742
Malicious code in zeal-rq-hooks (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (dcf7e926ec85f72f362263a19d4f99c4b215ddd94ed4454c669c3387cacee164) The package includes canary.js which imports os/http/https and, at line 123, POSTs a JSON body containing os.hostname(), os.userInfo(), process.platform, node/npm version, and cwd to the hardcoded endpoint https://npm-canary.aveliscare.com. The hostname is not associated with the npm registry or a documented publisher and is embedded directly in the package's own shipped code. The collected fields (hostname, username, platform, cwd) are host-identifying reconnaissance data, and the network destination is not user-configurable in the flagged code path.
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for zeal-rq-hooks (npm). Pin to a known-safe version or switch to an alternative.