{
  "affected": [
    {
      "database_specific": {
        "cwes": [
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          }
        ],
        "indicators": {
          "evidence_files": [
            {
              "path": "postinstall.js",
              "sha256": "f23aca67400de96abcfaa7a7c0ef987ebe14cef43467110595c8abc4a51f532d",
              "tlsh": "fa51a75512b0237137f12ad0a84e54f5d322c3a6795979e4b18d02846bcb4fa42b62fb"
            }
          ],
          "package_integrity": [
            {
              "filename": "scan-https-d-1.0.0.tgz",
              "hashes": {
                "sha1": "f50c0ae29c524e0f135059f4c3779ed2906c2dd1",
                "sha512_sri": "sha512-1xxUqIEv1UbxyZhi/GGYOFDfw1ezF4Ny8LGm/Vas2bWUU97X+dl/PrgOkV7zsbSazyk69DzGPuDw6lhN10jzbw=="
              }
            }
          ]
        }
      },
      "package": {
        "ecosystem": "npm",
        "name": "@s4yhiitestpoc/scan-https-d"
      },
      "versions": [
        "1.0.0"
      ]
    }
  ],
  "credits": [
    {
      "contact": [
        "inspector-research@amazon.com"
      ],
      "name": "Amazon Inspector",
      "type": "FINDER"
    }
  ],
  "database_specific": {
    "malicious-packages-origins": [
      {
        "id": "IN-MAL-2026-021434",
        "import_time": "2026-10-11T14:18:05.348764552Z",
        "modified_time": "2026-10-11T13:58:59Z",
        "sha256": "1a1dd63de3f5e380c573cd6bcf885c9d0c7a5c503959dfde1a6c8b963a6ddaea",
        "source": "amazon-inspector",
        "versions": [
          "1.0.0"
        ]
      }
    ]
  },
  "details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (1a1dd63de3f5e380c573cd6bcf885c9d0c7a5c503959dfde1a6c8b963a6ddaea)\nOn `npm install`, postinstall.js collects installer host identity \u2014 os.hostname(), os.userInfo().username, home directory, cwd, non-internal network interface addresses, DNS servers, and platform/arch/release \u2014 and POSTs it as JSON over HTTPS to the hardcoded endpoint https://collector.oob.s4yhii.com/_npm-poc/beacon, with a secondary DNS lookup against *.oob.s4yhii.com as an out-of-band execution signal. The package\u0027s scope (`@s4yhiitestpoc/*`) and metadata self-describe this as a dependency-confusion proof-of-concept targeting internal namespaces that resolve to the public registry; the self-labeling does not change the fact that installer host identifiers leave the installer\u0027s machine on install to a hardcoded third-party domain the installer did not opt into.\n",
  "id": "MAL-2026-17766",
  "modified": "2026-10-11T13:58:59Z",
  "published": "2026-10-11T13:58:59Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/@s4yhiitestpoc/scan-https-d/v/1.0.0"
    }
  ],
  "schema_version": "1.7.4",
  "summary": "Malicious code in @s4yhiitestpoc/scan-https-d (npm)"
}