{"id":"MAL-2026-19224","kind":"package","aliases":["MAL-2026-19224"],"related":[],"title":"Malicious code in helper-agent (npm)","description":"---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (4ab651b6042b8ef6c2c986a58d276931d9353d723fd914c9b7c728cac5cf0fc9)\nThe package declares a postinstall script `node probe.cjs` that fires on every `npm install`. On execution it POSTs install-start and status markers to a hardcoded webhook.site dead-drop (https://webhook.site/a4bf0f9f-6d96-46e6-80ac-b76a5329f481), then scans several localhost ports (1337, 80, 3000, 8080, 5000) for a specific JSON API and, when a matching record (id `ECT-987654`) is found, issues a PUT that overwrites that service's manifest with an author-chosen status string. Both the outbound beacon destination and the local mutation target are hardcoded and not user-configurable. The package.json self-describes as an \"Authorized HTB dependency-resolution canary\" and the mutation path is gated to a narrow challenge record, but the install-time outbound beacon and localhost scanning fire unconditionally for any installer, confirming installer execution to a third-party collector and granting the author write access to a matching local service on the installer's host.","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"helper-agent","fixed":[],"affected":"= 1.0.4; = 1.0.1","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-13T03:55:49+00:00","first_seen_at":"2026-11-13T05:11:56+00:00","triaged_at":"2026-11-13T05:12:56+00:00","updated_at":"2026-11-13T05:14:00+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-19224':10A,13A '-2026':9A,12A '-987654':89C '/a4bf0f9f-6d96-46e6-80ac-b76a5329f481),':66C '1337':72C '3000':74C '4ab651b6042b8ef6c2c986a58d276931d9353d723fd914c9b7c728cac5cf0fc9':32C '5000':76C '80':73C '8080':75C 'access':178C 'agent':6A,16A 'amazon':30C 'amazon-inspector':29C 'api':81C 'author':104C,132C,176C 'author-chosen':103C 'beacon':111C,155C 'canari':137C 'challeng':147C 'chosen':105C 'code':2A 'collector':172C 'configur':124C 'confirm':164C 'dead':62C 'dead-drop':61C 'declar':35C 'depend':135C 'dependency-resolut':134C 'describ':129C 'destin':112C 'detail':21C 'drop':63C 'ect':88C 'edit':24C 'everi':44C 'execut':48C,166C 'fire':42C,159C 'found':91C 'gate':143C 'grant':174C 'hardcod':59C,119C 'helper':5A,15A 'helper-ag':4A 'helper-agent':14A 'host':188C 'htb':133C 'id':87C 'inspector':31C 'instal':46C,52C,152C,163C,165C,186C 'install-start':51C 'install-tim':151C 'issu':92C 'json':80C 'line':27C 'local':115C,182C 'localhost':70C,157C 'mal':8A,11A 'malici':1A,17B 'manifest':100C 'marker':56C 'match':85C,181C 'mutat':116C,140C 'narrow':146C 'node':39C 'npm':7A,45C 'outbound':110C,154C 'overwrit':96C 'packag':18B,34C 'package.json':126C 'parti':171C 'path':141C 'per':19C 'port':71C 'post':50C 'postinstal':37C 'probe.cjs':40C 'put':94C 'record':86C,148C 'resolut':136C 'scan':68C,158C 'script':38C 'self':128C 'self-describ':127C 'servic':98C,183C 'sever':69C 'sourc':20C,28C 'specif':79C 'start':53C 'status':55C,106C 'string':107C 'target':117C 'third':170C 'third-parti':169C 'time':153C 'uncondit':160C 'user':123C 'user-configur':122C 'webhook.site':60C,65C 'webhook.site/a4bf0f9f-6d96-46e6-80ac-b76a5329f481),':64C 'write':177C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["helperagent"],"ptokens":["agent","helper"],"labels":["critical","malicious","npm","package"],"campaign_type":null,"search_a":"'-19224':10A,13A '-2026':9A,12A 'agent':6A,16A 'code':2A 'helper':5A,15A 'helper-ag':4A 'helper-agent':14A 'mal':8A,11A 'malici':1A 'npm':7A","search_b":"'malici':17B 'packag':18B","search_c":"'-987654':89C '/a4bf0f9f-6d96-46e6-80ac-b76a5329f481),':66C '1337':72C '3000':74C '4ab651b6042b8ef6c2c986a58d276931d9353d723fd914c9b7c728cac5cf0fc9':32C '5000':76C '80':73C '8080':75C 'access':178C 'amazon':30C 'amazon-inspector':29C 'api':81C 'author':104C,132C,176C 'author-chosen':103C 'beacon':111C,155C 'canari':137C 'challeng':147C 'chosen':105C 'collector':172C 'configur':124C 'confirm':164C 'dead':62C 'dead-drop':61C 'declar':35C 'depend':135C 'dependency-resolut':134C 'describ':129C 'destin':112C 'detail':21C 'drop':63C 'ect':88C 'edit':24C 'everi':44C 'execut':48C,166C 'fire':42C,159C 'found':91C 'gate':143C 'grant':174C 'hardcod':59C,119C 'host':188C 'htb':133C 'id':87C 'inspector':31C 'instal':46C,52C,152C,163C,165C,186C 'install-start':51C 'install-tim':151C 'issu':92C 'json':80C 'line':27C 'local':115C,182C 'localhost':70C,157C 'manifest':100C 'marker':56C 'match':85C,181C 'mutat':116C,140C 'narrow':146C 'node':39C 'npm':45C 'outbound':110C,154C 'overwrit':96C 'packag':34C 'package.json':126C 'parti':171C 'path':141C 'per':19C 'port':71C 'post':50C 'postinstal':37C 'probe.cjs':40C 'put':94C 'record':86C,148C 'resolut':136C 'scan':68C,158C 'script':38C 'self':128C 'self-describ':127C 'servic':98C,183C 'sever':69C 'sourc':20C,28C 'specif':79C 'start':53C 'status':55C,106C 'string':107C 'target':117C 'third':170C 'third-parti':169C 'time':153C 'uncondit':160C 'user':123C 'user-configur':122C 'webhook.site':60C,65C 'webhook.site/a4bf0f9f-6d96-46e6-80ac-b76a5329f481),':64C 'write':177C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T03:55:49+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-19224","url":"https://osv.dev/vulnerability/MAL-2026-19224","severity":"critical","published_at":"2026-11-13T03:55:49+00:00","modified_at":"2026-11-13T04:30:04+00:00","first_seen_at":"2026-11-13T05:11:56+00:00","fetched_at":"2026-11-13T05:11:56+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}