tetotest@14.0.0
Vulnerability report · Last retrieved from osv.dev September 16, 2026 at 3:29 PM UTC
OSV ID
MAL-2026-16217
Ecosystem
npm
Summary
package.json declares preinstall and postinstall lifecycle scripts that invoke wget to POST the installer's shell-expanded working directory ($(pwd)) and machine hostname ($(hostname)) to a hardcoded Discord webhook at https://discord.com/api/webhooks/1413937656697720862/<redacted>. Both hooks fire automatically on npm install without user interaction. The package ships no library code or documented functionality — its sole effect is beaconing installer host identifiers to an attacker-controlled Discord endpoint.
Source: amazon-inspector (b181542b0c55a472e316ca973cc5b1deaf31986645fd326903e8c31ab20acab6)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.