{"affected":[{"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"bin/cli-http-linux","sha256":"87e438dabcb8d45f52cc17578303341402186a561f04167e7c1aeeaa00e9e0a4","tlsh":"92088d27b1a2a498d453807027df8762a632f87a172465db32d89f323f37cd16779722"},{"path":"package.json","sha256":"47013222afd5e3a6e15ba87fed7a47d70aef5194f91c546299025daadeee7539","tlsh":"46f05c34ce381c1320d8e9556c351206b031dc5b08247c28336b115c4b9d27f50fd96c"},{"path":"src/index.js","sha256":"6aeb5bf46a51db6cd1a4dd21cd1c895b015f2a63a39871a23e215f18184ddd6e","tlsh":"2c412258288661a2452270b027cbb061b6e5d02f3076e0d5f0ed64906fddc78a6f6ffd"}],"package_integrity":[{"filename":"hachutis-1.0.6.tgz","hashes":{"sha1":"3caf0aab5a7dbf297e85296e6627e0b0be7b9e2c","sha512_sri":"sha512-rulUQCsN17zwGvW+N5z/MrOn262RgxRW2VW6TY5CktLvzbOCE4mIkkpcOaIbuq3mIxbmzakClsF+cQC33AX7+Q=="}}]}},"package":{"ecosystem":"npm","name":"hachutis"},"versions":["1.0.6","1.0.0"]}],"credits":[{"contact":["inspector-research@amazon.com"],"name":"Amazon Inspector","type":"FINDER"}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-020458","import_time":"2026-09-23T05:18:35.570674872Z","modified_time":"2026-09-23T05:05:04Z","sha256":"455f1d04545c9ed17722705fe61415d7e536e2800c2a3c588ab69985004c73b9","source":"amazon-inspector","versions":["1.0.6"]},{"id":"IN-MAL-2026-020459","import_time":"2026-09-23T05:18:35.883053658Z","modified_time":"2026-09-23T05:05:16Z","sha256":"8bf0269b9f1d010329c2005ab1908b3ac9952eae4302f8e08e6a52c848143152","source":"amazon-inspector","versions":["1.0.0"]}]},"details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (455f1d04545c9ed17722705fe61415d7e536e2800c2a3c588ab69985004c73b9)\nThe tarball ships three undeclared prebuilt executables under bin/ (bin/cli, bin/cli-linux-amd64, and an 81 MB Bun-compiled bin/cli-http-linux) that are not exposed via package.json.bin. The manifest's only bin entry hatcher-env points to bin/cli.js, which is absent from the tarball, and the declared main src/index.js is an unrelated dotenv-style parser hardcoded to /home/hatch/test.dat with no reference to the shipped binaries. The bundled JS region of bin/cli-http-linux embeds the anonymous Cloudflare Tunnel host already-query-bacteria-agreed.trycloudflare.com adjacent to HTTP POST verbs, and the README instructs the installer to execute one of the./bin/ binaries at least once to 'activate the package in our systems.' Running the binary opens a channel from the installer's host to an attacker-controlled trycloudflare.com tunnel; the readable JS surface is a decoy for opaque native payloads whose actual behavior is not documented.\n","id":"MAL-2026-16464","modified":"2026-09-23T05:20:39Z","published":"2026-09-23T05:05:04Z","references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/hachutis/v/1.0.6"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/hachutis/v/1.0.0"}],"schema_version":"1.7.4","summary":"Malicious code in hachutis (npm)"}