Vulnerability MAL-2026-18607
Unknown
UNKNOWN RISK
Vulnerabilities without an assigned CVSS score. Severity is not determinable from available data.
2 days ago
November 02, 2026 at 09:44 AM UTC
Malicious code in et_phone_home (npm)
0.0.5
0.0.5
Summary
Malicious code in et_phone_home (npm)
Details
Runs on install. The postinstall script fetches a path from a bare IPv4 address with wget, contacting a remote host from every machine that installs the package. Version examined: 0.0.5; tarball SHA-256 58f9b4c9c26abe6ac52353ce1e0a824fba06c8aa7cefa94d2d4805306053e82c.
Impacted packages
Timeline
Published
2 days ago
November 02, 2026 at 09:44 AM UTC
Last Modified
12 hours ago
November 04, 2026 at 09:00 AM UTC