{"id":"MAL-2026-12435","kind":"package","aliases":["MAL-2026-12435"],"related":[],"title":"Malicious code in sc-geeksquad-core (npm)","description":"---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (2fd2458d8a5843f57187868a2c244a376dd3d2daef420d3c564c775ef6a2782a)\nsc-geeksquad-core@9999.0.0 declares a preinstall script `node callback.js` that runs automatically on `npm install`. The script collects the installer's hostname (`os.hostname()`), OS username (`os.userInfo().username`), current working directory (`process.cwd()`), configured npm registry (`npm_config_registry`), and a set of CI repository-slug environment variables (GITHUB_REPOSITORY, CI_PROJECT_PATH, BUILD_REPOSITORY_NAME, BITBUCKET_REPO_FULL_NAME, TRAVIS_REPO_SLUG, DRONE_REPO, BUILDKITE_PIPELINE_SLUG, CIRCLE_PROJECT_REPONAME, JOB_NAME), then sends them via HTTP GET to the hardcoded bare-IP endpoint `http://75.119.137.232:31337/depconfuse` as query parameters. The placeholder version `9999.0.0` combined with a generic scoped-sounding name is the canonical dependency-confusion reconnaissance shape: the package is published to public npm to intercept internal-package name resolution and beacon back which private-namespace builds are vulnerable to substitution.\n\n## Source: ossf-package-analysis (2094a7f35be1c723c65b36c32884f2f0e99840ef0bc090a1fbcb1f5568b93ef2)\nThe OpenSSF Package Analysis project identified 'sc-geeksquad-core' @ 99.9.1 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package communicates with a domain associated with malicious activity.","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"sc-geeksquad-core","fixed":[],"affected":"= 9999.0.0; = 99.9.1","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-08-05T13:07:29+00:00","first_seen_at":"2026-10-26T20:51:52+00:00","triaged_at":"2026-10-26T21:12:36+00:00","updated_at":"2026-10-26T21:12:36+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-12435':11A,14A '-2026':10A,13A '2094a7f35be1c723c65b36c32884f2f0e99840ef0bc090a1fbcb1f5568b93ef2':178C '2fd2458d8a5843f57187868a2c244a376dd3d2daef420d3c564c775ef6a2782a':34C '31337/depconfuse':123C '75.119.137.232':122C '99.9.1':189C '9999.0.0':39C,130C 'activ':207C 'amazon':32C 'amazon-inspector':31C 'analysi':177C,182C 'associ':204C 'automat':48C 'back':163C 'bare':119C 'bare-ip':118C 'beacon':162C 'bitbucket':92C 'build':89C,168C 'buildkit':101C 'callback.js':45C 'canon':141C 'ci':78C,86C 'circl':104C 'code':2A 'collect':54C 'combin':131C 'communic':200C 'config':72C 'configur':68C 'confus':144C 'consid':195C 'core':7A,18A,38C,188C 'current':64C 'declar':40C 'depend':143C 'dependency-confus':142C 'detail':23C 'directori':66C 'domain':203C 'drone':99C 'edit':26C 'endpoint':121C 'environ':82C 'full':94C 'geeksquad':6A,17A,37C,187C 'generic':134C 'get':114C 'github':84C 'hardcod':117C 'hostnam':58C 'http':113C 'identifi':184C 'inspector':33C 'instal':51C,56C 'intercept':155C 'intern':157C 'internal-packag':156C 'ip':120C 'job':107C 'line':29C 'mal':9A,12A 'malici':1A,19B,192C,196C,206C 'name':91C,95C,108C,138C,159C 'namespac':167C 'node':44C 'npm':8A,50C,69C,71C,153C,190C 'openssf':180C 'os':60C 'os.hostname':59C 'os.userinfo':62C 'ossf':175C 'ossf-package-analysi':174C 'packag':20B,148C,158C,176C,181C,199C 'paramet':126C 'path':88C 'per':21C 'pipelin':102C 'placehold':128C 'preinstal':42C 'privat':166C 'private-namespac':165C 'process.cwd':67C 'project':87C,105C,183C 'public':152C 'publish':150C 'queri':125C 'reconnaiss':145C 'registri':70C,73C 'repo':93C,97C,100C 'reponam':106C 'repositori':80C,85C,90C 'repository-slug':79C 'resolut':160C 'run':47C 'sc':5A,16A,36C,186C 'sc-geeksquad-cor':4A,35C,185C 'sc-geeksquad-core':15A 'scope':136C 'scoped-sound':135C 'script':43C,53C 'send':110C 'set':76C 'shape':146C 'slug':81C,98C,103C 'sound':137C 'sourc':22C,30C,173C 'substitut':172C 'travi':96C 'usernam':61C,63C 'variabl':83C 'version':129C 'via':112C 'vulner':170C 'work':65C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-08-05T13:07:29+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-12435","url":"https://osv.dev/vulnerability/MAL-2026-12435","severity":"critical","published_at":"2026-08-05T13:07:29+00:00","modified_at":"2026-10-25T15:30:04+00:00","first_seen_at":"2026-10-26T20:51:52+00:00","fetched_at":"2026-10-26T20:51:52+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}