{"id":"MAL-2026-19223","kind":"package","aliases":["MAL-2026-19223"],"related":[],"title":"Malicious code in curse-allies-module (npm)","description":"---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (15e9740e7be22c3d68a1784e48d3e87414347b5e5697397ef0d8ab2295619962)\nOn npm install, the package runs a postinstall lifecycle script (`node probe.cjs`) that issues an HTTPS POST to a hardcoded webhook.site collector URL (https://webhook.site/a4bf0f9f-6d96-46e6-80ac-b76a5329f481) with the marker string `CURSE_DEPENDENT_REMOTE_INSTALL_PROBE`. The beacon fires unconditionally at install time with no configuration or opt-out, signaling to a third-party collector that the package resolved and executed inside the installer's environment. This is the canonical dependency-confusion / reconnaissance canary shape: the attacker learns that a given name resolves on the target's internal build infrastructure, enabling follow-on targeted attacks against environments where the name was expected to resolve privately.","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"curse-allies-module","fixed":[],"affected":"= 1.0.0","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-13T03:55:32+00:00","first_seen_at":"2026-11-13T05:11:56+00:00","triaged_at":"2026-11-13T05:12:56+00:00","updated_at":"2026-11-13T05:14:00+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-19223':11A,14A '-2026':10A,13A '/a4bf0f9f-6d96-46e6-80ac-b76a5329f481)':61C '15e9740':34C 'alli':6A 'allies':17A 'amazon':32C 'amazon-inspector':31C 'attack':114C,133C 'beacon':72C 'build':126C 'canari':111C 'canon':106C 'code':2A 'collector':57C,91C 'configur':80C 'confus':109C 'curs':5A,66C 'curse':16A 'curse-allies-modul':4A 'curse-allies-module':15A 'depend':67C,108C 'dependency-confus':107C 'detail':23C 'e7be22c3d68a1784e48d3e87414347b5e5697397ef0d8ab2295619962':35C 'edit':26C 'enabl':128C 'environ':102C,135C 'execut':97C 'expect':140C 'fire':73C 'follow':130C 'follow-on':129C 'given':118C 'hardcod':55C 'https':51C 'infrastructur':127C 'insid':98C 'inspector':33C 'instal':38C,69C,76C,100C 'intern':125C 'issu':49C 'learn':115C 'lifecycl':44C 'line':29C 'mal':9A,12A 'malici':1A,19B 'marker':64C 'modul':7A 'module':18A 'name':119C,138C 'node':46C 'npm':8A,37C 'opt':83C 'opt-out':82C 'packag':20B,40C,94C 'parti':90C 'per':21C 'post':52C 'postinstal':43C 'privat':143C 'probe':70C 'probe.cjs':47C 'reconnaiss':110C 'remot':68C 'resolv':95C,120C,142C 'run':41C 'script':45C 'shape':112C 'signal':85C 'sourc':22C,30C 'string':65C 'target':123C,132C 'third':89C 'third-parti':88C 'time':77C 'uncondit':74C 'url':58C 'webhook.site':56C,60C 'webhook.site/a4bf0f9f-6d96-46e6-80ac-b76a5329f481)':59C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["cursealliesmodule"],"ptokens":["allies","curse","module"],"labels":["critical","malicious","npm","package"],"campaign_type":null,"search_a":"'-19223':11A,14A '-2026':10A,13A 'alli':6A 'allies':17A 'code':2A 'curs':5A 'curse':16A 'curse-allies-modul':4A 'curse-allies-module':15A 'mal':9A,12A 'malici':1A 'modul':7A 'module':18A 'npm':8A","search_b":"'malici':19B 'packag':20B","search_c":"'/a4bf0f9f-6d96-46e6-80ac-b76a5329f481)':61C '15e9740':34C 'amazon':32C 'amazon-inspector':31C 'attack':114C,133C 'beacon':72C 'build':126C 'canari':111C 'canon':106C 'collector':57C,91C 'configur':80C 'confus':109C 'curs':66C 'depend':67C,108C 'dependency-confus':107C 'detail':23C 'e7be22c3d68a1784e48d3e87414347b5e5697397ef0d8ab2295619962':35C 'edit':26C 'enabl':128C 'environ':102C,135C 'execut':97C 'expect':140C 'fire':73C 'follow':130C 'follow-on':129C 'given':118C 'hardcod':55C 'https':51C 'infrastructur':127C 'insid':98C 'inspector':33C 'instal':38C,69C,76C,100C 'intern':125C 'issu':49C 'learn':115C 'lifecycl':44C 'line':29C 'marker':64C 'name':119C,138C 'node':46C 'npm':37C 'opt':83C 'opt-out':82C 'packag':40C,94C 'parti':90C 'per':21C 'post':52C 'postinstal':43C 'privat':143C 'probe':70C 'probe.cjs':47C 'reconnaiss':110C 'remot':68C 'resolv':95C,120C,142C 'run':41C 'script':45C 'shape':112C 'signal':85C 'sourc':22C,30C 'string':65C 'target':123C,132C 'third':89C 'third-parti':88C 'time':77C 'uncondit':74C 'url':58C 'webhook.site':56C,60C 'webhook.site/a4bf0f9f-6d96-46e6-80ac-b76a5329f481)':59C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T03:55:32+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-19223","url":"https://osv.dev/vulnerability/MAL-2026-19223","severity":"critical","published_at":"2026-11-13T03:55:32+00:00","modified_at":"2026-11-13T04:30:04+00:00","first_seen_at":"2026-11-13T05:11:56+00:00","fetched_at":"2026-11-13T05:11:56+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}