{"id":"MAL-2026-18607","kind":"package","aliases":["MAL-2026-18607"],"related":[],"title":"Malicious code in et_phone_home (npm)","description":"Runs on install. The postinstall script fetches a path from a bare IPv4 address with wget, contacting a remote host from every machine that installs the package. Version examined: 0.0.5; tarball SHA-256 58f9b4c9c26abe6ac52353ce1e0a824fba06c8aa7cefa94d2d4805306053e82c.","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"et_phone_home","fixed":[],"affected":"= 0.0.5","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-02T09:44:21+00:00","first_seen_at":"2026-11-04T09:25:52+00:00","triaged_at":"2026-11-04T09:26:43+00:00","updated_at":"2026-11-04T09:28:08+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-18607':10A,13A '-2026':9A,12A '-256':51C '0.0.5':48C '58f9b4c9c26abe6ac52353ce1e0a824fba06c8aa7cefa94d2d4805306053e82c':52C 'address':32C 'bare':30C 'code':2A 'contact':35C 'et':4A,14A 'everi':40C 'examin':47C 'fetch':25C 'home':6A,16A 'host':38C 'instal':21C,43C 'ipv4':31C 'machin':41C 'mal':8A,11A 'malici':1A,17B 'npm':7A 'packag':18B,45C 'path':27C 'phone':5A,15A 'postinstal':23C 'remot':37C 'run':19C 'script':24C 'sha':50C 'tarbal':49C 'version':46C 'wget':34C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["etphonehome"],"ptokens":["et","home","phone"],"labels":["critical","malicious","npm","package"],"campaign_type":null,"first_public_at":"2026-11-02T09:44:21+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-18607","url":"https://osv.dev/vulnerability/MAL-2026-18607","severity":"critical","published_at":"2026-11-02T09:44:21+00:00","modified_at":"2026-11-04T09:00:05+00:00","first_seen_at":"2026-11-04T09:25:52+00:00","fetched_at":"2026-11-04T09:25:52+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}