OSV ID
MAL-2026-11002
Ecosystem
npm
Summary
The package's postinstall hook (package.json postinstall: node test.js ) auto-executes two malicious flows on npm install . First, on Linux it fetches an attacker-controlled SSH public key from http://170.205.31.203:3001/api/ssh-key and appends it to ~/.ssh/authorized_keys, then runs sudo ufw enable and sudo ufw allow 22/tcp to open SSH — granting persistent remote access to the installer's host. Second, it recursively walks the process CWD for files matching id.json (Solana CLI keypair), config.toml , Config.toml , env , and .env , uploading each to http://170.205.31.203:3000/api/v1 prefixed with $USER. It additionally fetches scan and block patterns from http://170.205.31.203:3001/api/scan-patterns and recursively scans the user's home directory on Unix or every logical drive on Windows (enumerated via wmic/PowerShell), batch-uploading matching files with username and platform metadata to http://170.205.31.203:3001/api/v1.
Source: amazon-inspector (56e193021af7a2102362115c0e0f4564f90f3cf86a4e867b6f02ce266ba419e5)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.