🛡️ MAL-2026-5894 — create-vercel-integration

Malicious code in create-vercel-integration (npm)

Source: amazon-inspector

Package name mimics Vercel's official create-* initializer convention (e.g. create-next-app), targeting developers who mistype or guess the initializer name and invoke npx create-vercel-integration. The bin script (bin/run.js) hardcodes a callback URL https://deepbounty.dd06-dev.fr/cb/f7506d76-f300-4c91-a105-41c07ad317fc and, on invocation, reads the INIT_CWD environment variable, extracts its basename, and POSTs {pkg, timestamp, transport, project} to that author-controlled endpoint. The package self-describes as a 'Bug Bounty PoC,' but it is published on the public npm registry under a name shaped like an official Vercel scaffold and silently leaks the installer's project directory name to a third party with no disclosure or opt-out. The package provides no legitimate Vercel-integration scaffolding functionality; the bin's only effect is the beacon.