{
  "affected": [
    {
      "database_specific": {
        "cwes": [
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          }
        ],
        "indicators": {
          "evidence_files": [
            {
              "path": "package.json",
              "sha256": "6dd2fe7c4dc3b92baca6b52f1cf89fff5b3211862346a9c12ff668cb504595dd",
              "tlsh": "1cf0acf25d10e572bbcb0ea63ad29a4a7aa39d4f1881163cd1034b0c03ce36f10b1a46"
            }
          ],
          "package_integrity": [
            {
              "filename": "tetomood-12.0.0.tgz",
              "hashes": {
                "sha1": "5cd6977336999b4253f6f41b7acf3a7219d3f70a",
                "sha512_sri": "sha512-Xj2Hkfw/BbWGGloD+hhQF25xzK2lK/a+BFzrV6+Fd3RnIkng927oY5dyV2y3jUJjkEYnNmF5Y3yi/MofMSGIcg=="
              }
            }
          ]
        }
      },
      "package": {
        "ecosystem": "npm",
        "name": "tetomood"
      },
      "versions": [
        "12.0.0"
      ]
    }
  ],
  "credits": [
    {
      "contact": [
        "inspector-research@amazon.com"
      ],
      "name": "Amazon Inspector",
      "type": "FINDER"
    }
  ],
  "database_specific": {
    "malicious-packages-origins": [
      {
        "id": "IN-MAL-2026-020086",
        "import_time": "2026-09-16T06:56:08.843090937Z",
        "modified_time": "2026-09-16T06:35:38Z",
        "sha256": "6c09686feb7c38e815ef9a615a6ceba2444029a34ea9d6bee8598a76bc8e8f92",
        "source": "amazon-inspector",
        "versions": [
          "12.0.0"
        ]
      }
    ]
  },
  "details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (6c09686feb7c38e815ef9a615a6ceba2444029a34ea9d6bee8598a76bc8e8f92)\npackage.json declares both preinstall and postinstall scripts that invoke wget to POST the installer\u0027s current working directory ($(pwd)) and machine hostname ($(hostname)) to a hardcoded Discord webhook endpoint on discord.com at install time. The tarball ships only package.json (611 bytes); the declared main entry index.js is absent, so the package has no legitimate functionality \u2014 the lifecycle beacons are its sole purpose. Installing the package causes automatic host reconnaissance data to be sent to an author-controlled remote endpoint without consent.\n",
  "id": "MAL-2026-16216",
  "modified": "2026-09-16T06:35:38Z",
  "published": "2026-09-16T06:35:38Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/tetomood/v/12.0.0"
    }
  ],
  "schema_version": "1.7.4",
  "summary": "Malicious code in tetomood (npm)"
}