MAL-2026-16435
Malicious code in catqrcodeconverter (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (3333f7b95e551ebf6ed266fb1de661b7419520ed3a922b05910ede132c7d6757) Package catqrcodeconverter@99.2.1 wires both preinstall and postinstall lifecycle hooks in package.json to execute scripts/run.js. On npm install, run.js reads the installer's OS username via os.userInfo() and hostname via os.hostname() and POSTs them as JSON (with the package name) to a hardcoded collector at https://webhook.site/8beeee0f-4dd4-4b25-8588-5a5f83fe6ed2, and issues a DNS canary lookup to 8beeee0f-4dd4-4b25-8588-5a5f83fe6ed2.dnshook.site. The implausibly high version number (99.2.1) is consistent with a dependency-confusion lure intended to win resolution against an internal package name. Installer host identifiers are transmitted to an attacker-controlled endpoint without any user interaction beyond the install command.
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for catqrcodeconverter (npm). Pin to a known-safe version or switch to an alternative.