🛡️ MAL-2026-12065 — greatcall-customers-commandapi

Malicious code in greatcall-customers-commandapi (npm)

Source: amazon-inspector

[email protected] is a dependency-confusion attack package. package.json self-describes as "Dependency confusion PoC" and declares preinstall, install, and postinstall lifecycle scripts all invoking node index.js. On any of the three install hooks, index.js collects host identifiers (os.hostname(), os.userInfo(), homedir, platform, cwd, network interfaces), captures the output of whoami and ls -la via child_process.execSync, and enumerates process.env filtering for credential-shaped keys matching /KEY|SECRET|TOKEN|PASS|AUTH|CRED|PRIVATE|AWS_|AZURE_|GCP_|GITHUB|NPM|DB_|DATABASE|API|WEBHOOK|JENKINS|OCTOPUS|CONNECTION/i, then POSTs the collected payload to a hardcoded webhook at https://test.v3n.my/pwn via https.request. The 99.0.0 version and internal-sounding name are the canonical dependency-confusion shape used to override a private registry package of the same name.