catqrcodeconverter

GHSA-f639-24m5-rmxp

Malicious code in catqrcodeconverter (npm)

Details

**Severity:** Critical

**Affected versions:** `= 99.2.1`

## Source: amazon-inspector (3333f7b95e551ebf6ed266fb1de661b7419520ed3a922b05910ede132c7d6757)
Package [email protected] wires both preinstall and postinstall lifecycle hooks in package.json to execute scripts/run.js. On npm install, run.js reads the installer's OS username via os.userInfo() and hostname via os.hostname() and POSTs them as JSON (with the package name) to a hardcoded collector at https://webhook.site/8beeee0f-4dd4-4b25-8588-5a5f83fe6ed2, and issues a DNS canary lookup to 8beeee0f-4dd4-4b25-8588-5a5f83fe6ed2.dnshook.site. The implausibly high version number (99.2.1) is consistent with a dependency-confusion lure intended to win resolution against an internal package name. Installer host identifiers are transmitted to an attacker-controlled endpoint without any user interaction beyond the install command.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/c654723e238cbf7547b8e05e287837f94bfbbff0/osv/malicious/npm/catqrcodeconverter/MAL-2026-16435.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/c654723e238cbf7547b8e05e287837f94bfbbff0/osv/malicious/npm/catqrcodeconverter/MAL-2026-16435.json
- https://www.npmjs.com/package/catqrcodeconverter/v/99.2.1
- https://github.com/advisories/GHSA-f639-24m5-rmxp

Compromised versions (1)

= 99.2.1

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.