MAL-2026-10200

Dashboard / Malicious Package / MAL-2026-10200

MAL-2026-10200

Summary: Malicious code in api-changelly (npm)

Details: Source: amazon-inspector (a94f4aa368f1838507a78dde78062b740a5853b516d9d32782d0264b539b724c) The package declares `preinstall: node index.js`, which runs automatically on `npm install`. index.js collects installer identifiers (os.hostname(), os.platform(), os.arch(), os.userInfo() username/uid/gid/shell, home directory, cwd) and executes `whoami` and `id` via child_process.exec, capturing their output. The combined JSON payload is POSTed to a hardcoded Burp Collaborator subdomain `https://1439tg4d02vixhxuj0gadpml4ca3ytmi.oastify.com/detox56`. The package name `api-changelly` impersonates the Changelly crypto-exchange brand and ships no legitimate functionality — the only behavior is the install-time beacon. This is the canonical dependency-confusion / reconnaissance-beacon shape targeting internal build systems that may resolve a private `changelly`-family dependency to this public package.

References: https://www.npmjs.com/package/api-changelly/v/19.2.11, https://github.com/advisories/GHSA-3835-mjjv-wqw8