Note: This report is updated by a verification record
Malicious package due to arbitrary command execution, data exfiltration to Telegram, and a suspicious preinstall script executing code on installation.
The package is marked as malware by OSV: MAL-2026-2525 with source: amazon-inspector
Note: This report is updated by a verification record
The package exhibits multiple strong indicators of malicious behavior. The index.js file executes arbitrary commands and exfiltrates sensitive system information to a Telegram bot, as evidenced by the LLM analysis. Additionally, the package.json file contains a preinstall script that executes node index.js, enabling code execution upon installation, further solidifying the malicious nature of the package.
