{
  "affected": [
    {
      "database_specific": {
        "cwes": [
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          }
        ],
        "indicators": {
          "evidence_files": [
            {
              "path": "setup.js",
              "sha256": "bd9f3ae03989400b04bdd4841e9a78b75fb71c3a67e5b3fe1a3c76cb1636ba1e",
              "tlsh": "bae162a9087b11305867054b9b4f6034251ae20b3f69fce87f8d57058f4a72861e1bfe"
            },
            {
              "path": "package.json",
              "sha256": "d3c4172220df041586f4342505b01a674e06ae83cbb2483d9170aa99b21f48d1",
              "tlsh": "b8f02820c9216da356cb2a5b8c695146b6b54d0b050cfc1973cb411c8bdd66f24ff25d"
            }
          ],
          "package_integrity": [
            {
              "filename": "weight2loss-1.0.5.tgz",
              "hashes": {
                "sha1": "b322e762766e762e8a8b2fdfb994f2708a789897",
                "sha512_sri": "sha512-GLLOnD3k54Eh1jVYOSGyFtGa0ZIAKUBR9pYqVaFtXa9eIZoItnmn8vOIwK7aaKyweummzsHhx101n6ir96rLEg=="
              }
            }
          ]
        }
      },
      "package": {
        "ecosystem": "npm",
        "name": "weight2loss"
      },
      "versions": [
        "1.0.5"
      ]
    }
  ],
  "credits": [
    {
      "contact": [
        "inspector-research@amazon.com"
      ],
      "name": "Amazon Inspector",
      "type": "FINDER"
    }
  ],
  "database_specific": {
    "malicious-packages-origins": [
      {
        "id": "IN-MAL-2026-016845",
        "import_time": "2026-08-07T00:59:21.141987096Z",
        "modified_time": "2026-08-06T23:54:44Z",
        "sha256": "e8b80ee1c23ef1ae185bbda67deab7b442f673434427f2c006acb4e7f388a52e",
        "source": "amazon-inspector",
        "versions": [
          "1.0.5"
        ]
      }
    ]
  },
  "details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (e8b80ee1c23ef1ae185bbda67deab7b442f673434427f2c006acb4e7f388a52e)\nThe package ships setup.js, referenced by a postinstall hook in package.json, that on execution: (1) reads installer-side secrets from ~/.npmrc, ~/.ssh/*, ~/.gitconfig, ~/.aws/*, and a curated list of credential-shaped environment variables (GITHUB_TOKEN, AWS_SECRET_ACCESS_KEY, etc.); (2) exfiltrates the collected data, and a base64-encoded copy of process.env, to the hardcoded endpoint https://news.reimbursor.info via multiple POST requests, and additionally emails it through smtp.gmail.com using hardcoded attacker credentials (attacker.email@gmail.com); (3) pipes http://attacker.com/miner.sh and http://attacker.com/backdoor.sh into bash for immediate arbitrary code execution; (4) installs an hourly crontab entry that fetches and executes http://attacker.com/check via bash, establishing persistent remote command delivery; and (5) unlinks setup.js after execution to reduce forensic traces. The postinstall key is currently declared as a top-level package.json field rather than under scripts, so npm does not auto-invoke it on install in this exact version, but the full stealer/dropper/backdoor payload is present and functional if invoked (including by any require of setup.js or a corrected manifest). The declared purpose (fitness analytics) does not match any of the observed behavior.\n",
  "id": "MAL-2026-13485",
  "modified": "2026-08-06T23:54:44Z",
  "published": "2026-08-06T23:54:44Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/weight2loss/v/1.0.5"
    }
  ],
  "schema_version": "1.7.4",
  "summary": "Malicious code in weight2loss (npm)"
}