MAL-2026-10509

    Dashboard / Malicious Package / MAL-2026-10509

    MAL-2026-10509

    Published: 13 Jul 2026Last Modified: 13 Jul 2026

    Summary: Malicious code in test_adminet (npm)

    Details: Source: amazon-inspector (e1971734ce6221624b53d3647a5881c1fe0bc7f8ae4d383a5ff2a9f5080da57c) The package's package.json declares a preinstall hook that runs index.js. On npm install, index.js uses child_process.exec to curl-POST installer identifiers ($(whoami), $(hostname), id output) together with the contents of /etc/passwd, /etc/hosts, and /etc/shadow (base64-encoded and stuffed into the User-Agent header) to a hardcoded webhook.site endpoint. The /etc/shadow read attempts to harvest local password hashes; if the install runs as root (common in CI/Docker), hashes are transmitted off-host. Behavior fires automatically on default npm install with no user interaction.

    References: https://www.npmjs.com/package/test_adminet/v/99.9.9

    Affected packages

    Package

    Name: test_adminet

    Purl: pkg:npm/test_adminet

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    99.9.9
    MAL-2026-10509 | CVE-DB