MAL-2026-19223: Malicious code in curse-allies-module (npm)
--- -= Per source details. Do not edit below this line.=-
Source: amazon-inspector (15e9740e7be22c3d68a1784e48d3e87414347b5e5697397ef0d8ab2295619962) On npm install, the package runs a postinstall lifecycle script (node probe.cjs) that issues an HTTPS POST to a hardcoded webhook.site collector URL (https://webhook.site/a4bf0f9f-6d96-46e6-80ac-b76a5329f481) with the marker string CURSEDEPENDENTREMOTEINSTALLPROBE. The beacon fires unconditionally at install time with no configuration or opt-out, signaling to a third-party collector that the package resolved and executed inside the installer's environment. This is the canonical dependency-confusion / reconnaissance canary shape: the attacker learns that a given name resolves on the target's internal build infrastructure, enabling follow-on targeted attacks against environments where the name was expected to resolve privately.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this package's behavior?
Any environment that installs curse-allies-module through npm is exposed, because its postinstall script runs during installation and sends a beacon to the hardcoded third-party collector. Build infrastructure and internal environments are particularly relevant because the beacon indicates that the package name resolved and executed there.
Does exploitation require application code to import or execute the package?
No. The HTTPS POST is triggered unconditionally by the npm postinstall lifecycle script during installation, so importing or otherwise using the package is not required.
Can this be disabled through package configuration?
No configuration or opt-out is described. The beacon is stated to fire unconditionally at install time.
How can I determine whether the package executed in an environment?
Review dependency manifests, lockfiles, and npm installation logs for curse-allies-module version 1.0.0 or execution of the postinstall command "node probe.cjs". Network logs may also show an HTTPS POST to the listed webhook.site collector containing the marker string "CURSE_DEPENDENT_REMOTE_INSTALL_PROBE".