{
  "affected": [
    {
      "database_specific": {
        "cwes": [
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          },
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          },
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          }
        ],
        "indicators": {
          "evidence_files": [
            {
              "path": "install.js",
              "sha256": "5a4125c2c23ce80a01b1b8c311fcc2512712bff48849d06cce88a6895c191482",
              "tlsh": "7f81d7d9fef9811273e8b95536a64403bee7e67324197c903c491ad03fcc8ad02325ab"
            },
            {
              "path": "publish-and-arm.sh",
              "sha256": "597031dcb0a3e14212126e85b226c068bf3bf3e822488bc6f0710812dc551c72",
              "tlsh": "2e114683643a70b3c48fab81f504533157f7b5eb241b3520ddcc35e927aa1fd926916a"
            }
          ],
          "package_integrity": [
            {
              "filename": "module-index-cache-1.0.1.tgz",
              "hashes": {
                "sha1": "0d7832df4f45f5c5499926e64f133a52ac022e2f",
                "sha512_sri": "sha512-sFR9HBbqg+DKTzHUtPEP9jxI029YDM1xO4h+ZA69YVi1TplWvrtz3gk4/B0ldXdNtXf2b0YT2Ue9TFBiM5iaEA=="
              }
            }
          ]
        }
      },
      "package": {
        "ecosystem": "npm",
        "name": "module-index-cache"
      },
      "versions": [
        "1.0.1",
        "1.0.0",
        "1.0.2"
      ]
    }
  ],
  "credits": [
    {
      "contact": [
        "inspector-research@amazon.com"
      ],
      "name": "Amazon Inspector",
      "type": "FINDER"
    }
  ],
  "database_specific": {
    "malicious-packages-origins": [
      {
        "id": "IN-MAL-2026-007819",
        "import_time": "2026-06-30T21:35:50.443857523Z",
        "modified_time": "2026-06-30T21:00:08Z",
        "sha256": "9a947e4f5dba43d2cfe0428514bf4a787fc8f3d538fe5482b54508cc1c732099",
        "source": "amazon-inspector",
        "versions": [
          "1.0.1"
        ]
      },
      {
        "id": "IN-MAL-2026-007818",
        "import_time": "2026-06-30T21:35:50.324911778Z",
        "modified_time": "2026-06-30T21:00:00Z",
        "sha256": "cf55b479f7a8b550b2c5661e990f8cb3cff0d6c25886da004ada85d401f39372",
        "source": "amazon-inspector",
        "versions": [
          "1.0.0"
        ]
      },
      {
        "id": "IN-MAL-2026-007820",
        "import_time": "2026-06-30T21:35:50.597601082Z",
        "modified_time": "2026-06-30T21:00:15Z",
        "sha256": "d3b789fbaaf21d9554aa580105d73d992d4a82963e1ade3c6dca6290f5cd7a3e",
        "source": "amazon-inspector",
        "versions": [
          "1.0.2"
        ]
      }
    ]
  },
  "details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (d3b789fbaaf21d9554aa580105d73d992d4a82963e1ade3c6dca6290f5cd7a3e)\npackage.json declares preinstall, install, and postinstall hooks that all invoke install.js, so the payload runs unconditionally on `npm install`. install.js reads installer-side secrets and host data \u2014 /app/.env, /root/.npmrc, /home/node/.npmrc, /etc/npmrc, /app/.git/config, package.json, /proc/self/environ, and the full process.env (JSON-stringified, sliced to 15000 chars) \u2014 runs shell reconnaissance (id, hostname, whoami, ls, ps, find/grep for flag files), base64-encodes the bundle, and POSTs/PUTs it via http.request to the hardcoded endpoint http://154.57.164.76:30728/api/modules/ECT-839201. The tarball additionally ships publish-and-arm.sh and arm-aliases.sh, which document and automate publishing the package under aliases (curse-dependent, spectral-corsair, @spectral-corsair/cursed-modules) using `npm:module-index-cache@1.0.2` redirection \u2014 explicitly labeled `dependency-confusion` and `armed-alias-public-npm` \u2014 to weaponize name confusion against private-registry consumers. A CTF/cover-story framing in comments does not change the installer impact: any machine that installs this package leaks its environment variables, npm auth tokens, dotenv contents, git configuration, and selected source/filesystem data to an attacker-controlled host.\n",
  "id": "MAL-2026-6700",
  "modified": "2026-06-30T21:37:40Z",
  "published": "2026-06-30T21:00:00Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/module-index-cache/v/1.0.1"
    },
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/module-index-cache/v/1.0.0"
    },
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/module-index-cache/v/1.0.2"
    }
  ],
  "schema_version": "1.7.4",
  "summary": "Malicious code in module-index-cache (npm)"
}