{
  "affected": [
    {
      "database_specific": {
        "cwes": [
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          },
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          },
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          }
        ],
        "indicators": {
          "evidence_files": [
            {
              "path": "postinstall.js",
              "sha256": "9ca7a71fe48ba9a34e4e71ee46a5e39d0b189a1cf9e3406e7b2d4b7e9888ca19",
              "tlsh": "3781a59dbbf594a501d5b9846217640bbeefd627352eacd07a8c03f02fdc1b810b169d"
            },
            {
              "path": "publish-and-arm.sh",
              "sha256": "914443bf677378da4945a821de28a7c91db637e39e275a3b30ee317b179e47cf",
              "tlsh": "1431a68b71357173806ddb55b900533217f3b6ab672fb811e8dd34ed135a0f6a27a006"
            }
          ],
          "package_integrity": [
            {
              "filename": "ecto-corsair-flag-7kq3mz-1.0.2.tgz",
              "hashes": {
                "sha1": "b38b01ea5ee92d0c53120e122137a7fb672431f3",
                "sha512_sri": "sha512-PKRdQchYOdl1qlXamo4BYdDyC8dCsdiaq6A/c1dJ2qJgvMSKoviVFO7SvWsKLAdBFC4i4VY9Is6f8Nn314BzCg=="
              }
            }
          ]
        }
      },
      "package": {
        "ecosystem": "npm",
        "name": "ecto-corsair-flag-7kq3mz"
      },
      "versions": [
        "1.0.2",
        "1.0.0",
        "1.0.1"
      ]
    }
  ],
  "credits": [
    {
      "contact": [
        "inspector-research@amazon.com"
      ],
      "name": "Amazon Inspector",
      "type": "FINDER"
    }
  ],
  "database_specific": {
    "malicious-packages-origins": [
      {
        "id": "IN-MAL-2026-007821",
        "import_time": "2026-06-30T21:35:50.716175169Z",
        "modified_time": "2026-06-30T21:00:23Z",
        "sha256": "2a4dfa9f4805e5b44c7ccf3e4c3859abf8e9f0388f11e3daf6065f43c49e09ed",
        "source": "amazon-inspector",
        "versions": [
          "1.0.2"
        ]
      },
      {
        "id": "IN-MAL-2026-007822",
        "import_time": "2026-06-30T21:35:50.814129246Z",
        "modified_time": "2026-06-30T21:00:30Z",
        "sha256": "54d9460656276821368471252c6a7b1c42dc2fdfd89432aa796d71d5463a1fc7",
        "source": "amazon-inspector",
        "versions": [
          "1.0.0"
        ]
      },
      {
        "id": "IN-MAL-2026-007823",
        "import_time": "2026-06-30T21:35:50.916792534Z",
        "modified_time": "2026-06-30T21:00:38Z",
        "sha256": "b18aadaf5087b19b63d12456642141e5bfff9146bf1bf4fcfb11eed833b8c78c",
        "source": "amazon-inspector",
        "versions": [
          "1.0.1"
        ]
      }
    ]
  },
  "details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (2a4dfa9f4805e5b44c7ccf3e4c3859abf8e9f0388f11e3daf6065f43c49e09ed)\nPackage wires preinstall, install, and postinstall lifecycle hooks to run postinstall.js, which executes unconditionally on npm install. The script collects hostname, cwd, uid, and environment variables matching FLAG/CTF/NPM/REGISTRY/CI/GITHUB/RUNNER, reads candidate flag files, and uses child_process.execSync to recursively grep installer-side directories (/app, /workspace, /challenge, /home/runner/work/repo/repo,.,..,../..) for flag-shaped strings. The collected manifest is base64-encoded and PUT to http://154.57.164.76:30728/api/modules/\u003cid\u003e, with an additional GET beacon to webhook.site/755defab-ea42-4c1f-9804-43ec567439f5. postinstall.js also tests npm_config_registry against /verdaccio/i to detect successful dependency-confusion landings, and the shipped publish-and-arm.sh and README self-describe the package as an \u0027armed\u0027 dependency-confusion probe. Regardless of the CTF/probe framing, installing this package causes unconsented exfiltration of installer environment and filesystem contents to an attacker-controlled IP.\n",
  "id": "MAL-2026-6699",
  "modified": "2026-06-30T21:37:38Z",
  "published": "2026-06-30T21:00:23Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/ecto-corsair-flag-7kq3mz/v/1.0.2"
    },
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/ecto-corsair-flag-7kq3mz/v/1.0.0"
    },
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/ecto-corsair-flag-7kq3mz/v/1.0.1"
    }
  ],
  "schema_version": "1.7.4",
  "summary": "Malicious code in ecto-corsair-flag-7kq3mz (npm)"
}