MAL-2026-14016
Malicious code in preinstall-hook-webhook-callback-demo (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (d6e707d55368c2628038e0efaac35629fba6dbd520e66a7e29f9c6a86c69b2e1) package.json declares a preinstall lifecycle script that contacts webhook.site, an ephemeral request-capture service commonly used as an attacker-controlled exfiltration sink. The hook fires automatically on `npm install` before any user interaction, and webhook.site is not a first-party or documented destination for any legitimate build or runtime purpose of this package. The combination of an auto-executing preinstall script wired to an out-of-band capture endpoint is the shape of installer-side data exfiltration / callback beaconing at install time.
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for preinstall-hook-webhook-callback-demo (npm). Pin to a known-safe version or switch to an alternative.