MAL-2026-13951
Malicious code in functions-framework-nodejs (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (d4c9e327ae7e806fc6d270807180963349c0b7578b69f31336780d87323fdafa) Package `functions-framework-nodejs` is a typosquat of Google's `@google-cloud/functions-framework`. Its package.json declares `postinstall: node install.js`, and install.js runs `execSync("id")` on the installer's host, then POSTs the captured Unix user/group identity (with package name, version, and timestamp) to a hardcoded webhook.site collector URL. The advertised library surface (index.js) is a trivial stub exporting only name and version — the package's sole functional effect on install is the identity exfiltration. Package metadata self-labels as "For Security Research" by author "Berserk"; that label does not change the behavior: on `npm install`, installer-side host identity is sent to a third-party endpoint the installer did not configure.
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for functions-framework-nodejs (npm). Pin to a known-safe version or switch to an alternative.