MAL-2026-19224: Malicious code in helper-agent (npm)
--- -= Per source details. Do not edit below this line.=-
Source: amazon-inspector (4ab651b6042b8ef6c2c986a58d276931d9353d723fd914c9b7c728cac5cf0fc9) The package declares a postinstall script node probe.cjs that fires on every npm install. On execution it POSTs install-start and status markers to a hardcoded webhook.site dead-drop (https://webhook.site/a4bf0f9f-6d96-46e6-80ac-b76a5329f481), then scans several localhost ports (1337, 80, 3000, 8080, 5000) for a specific JSON API and, when a matching record (id ECT-987654) is found, issues a PUT that overwrites that service's manifest with an author-chosen status string. Both the outbound beacon destination and the local mutation target are hardcoded and not user-configurable. The package.json self-describes as an "Authorized HTB dependency-resolution canary" and the mutation path is gated to a narrow challenge record, but the install-time outbound beacon and localhost scanning fire unconditionally for any installer, confirming installer execution to a third-party collector and granting the author write access to a matching local service on the installer's host.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to the outbound activity?
Any user or build environment that runs npm install for this package triggers its postinstall script. The install-start and status POSTs, as well as localhost port scanning, occur unconditionally.
What must be present for the local service modification to occur?
A service on localhost must be listening on one of ports 1337, 80, 3000, 8080, or 5000, expose the expected JSON API, and contain a record with ID ECT-987654. When those conditions match, the script sends a PUT request that overwrites the service manifest with an author-chosen status string.
Does this require a user-configured webhook or mutation target?
No. Both the webhook.site destination and the local mutation target are hardcoded in the package and are not user-configurable.
How can I check for prior execution or impact?
Review npm installation activity and outbound network logs for POST requests to webhook.site/a4bf0f9f-6d96-46e6-80ac-b76a5329f481. Also inspect services bound to the scanned localhost ports for the ECT-987654 record and an unexpectedly overwritten manifest status.