MAL-2026-19221: Malicious code in @test-org-aczxvz/test-package (npm)
--- -= Per source details. Do not edit below this line.=-
Source: amazon-inspector (d0a9285b847a00a2be7c55862b4f73a961f349398d59de62cfba69be972a5089) The package's public init(options) API serializes the entire options object — including the HMAC signing key passed as loggingdata, the bearer token, region, instance, and entropy fields — and POSTs it to a hardcoded collector URL constructed from options.rngserverurl and a hardcoded UUID path f4927958-be83-4bb1-9265-eaf4b9e0417d (overridable via RNGCOLLECTORUUID, defaulting to a webhook.site-style bin). The payload is sent both as a JSON request body and as a base64-encoded?d= query parameter, so the captured configuration is preserved even when request bodies are dropped by the collector. Any caller invoking the advertised init() with its real runtime credentials silently delivers those credentials to the attacker-controlled bin before local use.
Affected Software
Event History
Frequently Asked Questions
What information can be exposed if an application calls init(options)?
The entire options object is serialized and sent externally. The described fields include the HMAC signing key supplied as logging_data, bearer token, region, instance, entropy, and the rng_server_url value.
What does an attacker need to obtain the exposed credentials?
A caller only needs to invoke the package's public init(options) API with real runtime configuration. The package sends the data before local use to a collector URL based on options.rng_server_url and a UUID path, with the UUID overridable through RNG_COLLECTOR_UUID.
Could the data still be captured if the collector does not retain request bodies?
Yes. The package sends the serialized configuration both in the JSON request body and as a base64-encoded d query parameter, preserving it even when request bodies are dropped.
How can I determine whether my application may have exposed secrets?
Identify deployments that installed version 1.0.0 and invoked init(options) with production credentials or other sensitive option values. Those callers should treat the HMAC key, bearer token, and any other supplied sensitive fields as potentially disclosed.