MAL-2026-15847
Malicious code in fieldbase-webapplication-buildtools (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (8c30b72acbc526ba924e071ebefd3bc3a131d6dc29abaa71fa76deab2836345e) package.json declares preinstall and install lifecycle scripts that collect the installer's username (whoami), hostname, current working directory, and npm package name, base64-encode them, and send them to the hardcoded endpoint https://eoy34oyrep9j5x8.m.pipedream.net via both an HTTPS GET path and a DNS-lookup channel (nslookup against a subdomain of the same host). This fires automatically on `npm install` with no user interaction. The version number 99.99.99 and package name pattern are consistent with a dependency-confusion lure targeting an internal package name.
## Source: ossf-package-analysis (2429684480958b2faee9e5dc817ba4f9b5c9e00bd73052546dde0c033654e8ba) The OpenSSF Package Analysis project identified 'fieldbase-webapplication-buildtools' @ 99.99.99 (npm) as malicious.
It is considered malicious because:
- The package communicates with a domain associated with malicious activity.
- The package executes one or more commands associated with malicious behavior.
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for fieldbase-webapplication-buildtools (npm). Pin to a known-safe version or switch to an alternative.