{"id":"MAL-2026-18519","kind":"package","aliases":["MAL-2026-18519"],"related":[],"title":"Malicious code in service-roles-registry (npm)","description":"---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (4b228283b1cc1ad44b34a38d3ca79fb5b3f14d278ff50447b1b631cfd4fab9e0)\nservice-roles-registry@99.0.2 runs index.js as a preinstall script. On npm install, index.js reads os.hostname(), os.userInfo().user, process.cwd(), and package metadata and POSTs them over HTTPS to the hardcoded endpoint https://eog6t9e6egptozp.m.pipedream.net. The version number (99.0.2) and name shape are consistent with a dependency-confusion lure intended to win resolution against an internal package of the same name. Installation causes host identifiers of the installing machine or build system to be transmitted to a third-party collector with no consent, documentation, or opt-out.","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"service-roles-registry","fixed":[],"affected":"= 99.0.2","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-03T06:29:09+00:00","first_seen_at":"2026-11-03T07:48:07+00:00","triaged_at":"2026-11-03T07:48:15+00:00","updated_at":"2026-11-03T07:51:56+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-18519':11A,14A '-2026':10A,13A '4b228283b1cc1ad44b34a38d3ca79fb5b3f14d278ff50447b1b631cfd4fab9e0':34C '99.0.2':39C,71C 'amazon':32C 'amazon-inspector':31C 'build':104C 'caus':96C 'code':2A 'collector':114C 'confus':81C 'consent':117C 'consist':76C 'depend':80C 'dependency-confus':79C 'detail':23C 'document':118C 'edit':26C 'endpoint':66C 'eog6t9e6egptozp.m.pipedream.net':67C 'hardcod':65C 'host':97C 'https':62C 'identifi':98C 'index.js':41C,49C 'inspector':33C 'instal':48C,95C,101C 'intend':83C 'intern':89C 'line':29C 'lure':82C 'machin':102C 'mal':9A,12A 'malici':1A,19B 'metadata':57C 'name':73C,94C 'npm':8A,47C 'number':70C 'opt':121C 'opt-out':120C 'os.hostname':51C 'os.userinfo':52C 'packag':20B,56C,90C 'parti':113C 'per':21C 'post':59C 'preinstal':44C 'process.cwd':54C 'read':50C 'registri':7A,38C 'registry':18A 'resolut':86C 'role':6A,37C 'roles':17A 'run':40C 'script':45C 'servic':5A,36C 'service':16A 'service-roles-registri':4A,35C 'service-roles-registry':15A 'shape':74C 'sourc':22C,30C 'system':105C 'third':112C 'third-parti':111C 'transmit':108C 'user':53C 'version':69C 'win':85C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["servicerolesregistry"],"ptokens":["registry","roles","service"],"labels":["critical","malicious","npm","package"],"first_public_at":"2026-11-03T06:29:09+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-18519","url":"https://osv.dev/vulnerability/MAL-2026-18519","severity":"critical","published_at":"2026-11-03T06:29:09+00:00","modified_at":"2026-11-03T06:45:06+00:00","first_seen_at":"2026-11-03T07:48:07+00:00","fetched_at":"2026-11-03T07:48:07+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}