MAL-2026-10717

Dashboard / Malicious Package / MAL-2026-10717

MAL-2026-10717

Summary: Malicious code in @onescience/onecode (npm)

Details: Source: amazon-inspector (713bf7fce40e177608dd5145e1662b4efd3da6c1597d9a1aeb15d7715b865205) The npm postinstall hook runs ensurePlatformBinary(), which downloads a.tgz archive from the hardcoded bare-IP URL https://218.90.133.98:4443/onecode_tgz/onecode-<ver>/onecode-linux-x64-<ver>.tgz, extracts it via `tar -xzf`, chmods the extracted file to 0o755, hardlinks it into bin/.onecode, and the shipped CLI launcher invokes it. The HTTPS request explicitly sets `rejectUnauthorized: false`, disabling TLS certificate verification, and no hash or signature check is performed on the downloaded artifact. The download destination is a bare IPv4 address on a non-standard port, not a publisher-owned domain or a recognized release host. The package name and launcher (@onescience/onecode) mirror the unrelated 'opencode' project — env-var fallbacks reference OPENCODE_BIN_PATH and bundled asset directories are named.opencode/session-seed and.opencode/oneskills — while the executable payload is retrieved from an unrelated hardcoded IP endpoint. Anyone controlling that host, or any on-path network attacker (TLS is disabled), can deliver arbitrary code that executes on every installer's machine.

References: https://www.npmjs.com/package/@onescience/onecode/v/1.14.50-202607161038, https://www.npmjs.com/package/@onescience/onecode/v/1.14.50-202607161710, https://www.npmjs.com/package/@onescience/onecode/v/1.14.50-202607161139, https://www.npmjs.com/package/@onescience/onecode/v/1.14.50-202607231111, https://www.npmjs.com/package/@onescience/onecode/v/1.14.50-202608041043, https://www.npmjs.com/package/@onescience/onecode/v/1.14.50-202607171833, https://www.npmjs.com/package/@onescience/onecode/v/1.14.50-202608041614, https://www.npmjs.com/package/@onescience/onecode/v/1.14.50-202607270920, https://www.npmjs.com/package/@onescience/onecode/v/1.14.50-202607271545, https://www.npmjs.com/package/@onescience/onecode/v/1.14.50-202607281814, https://www.npmjs.com/package/@onescience/onecode/v/1.14.50-202608031812, https://www.npmjs.com/package/@onescience/onecode/v/1.14.50-202607271808, https://www.npmjs.com/package/@onescience/onecode/v/1.14.50-202607281613, https://www.npmjs.com/package/@onescience/onecode/v/1.14.50-202607291705, https://www.npmjs.com/package/@onescience/onecode/v/1.14.50-202607301758, https://www.npmjs.com/package/@onescience/onecode/v/1.14.50-202607200911, https://www.npmjs.com/package/@onescience/onecode/v/1.14.50-202607231354, https://www.npmjs.com/package/@onescience/onecode/v/1.14.50-202607221649, https://www.npmjs.com/package/@onescience/onecode/v/1.14.50-202608061753, https://www.npmjs.com/package/@onescience/onecode/v/1.14.50-202607281527, https://www.npmjs.com/package/@onescience/onecode/v/1.14.50-202607311732, https://www.npmjs.com/package/@onescience/onecode/v/1.14.50-202607281758, https://www.npmjs.com/package/@onescience/onecode/v/1.14.50-202607311756, https://www.npmjs.com/package/@onescience/onecode/v/1.14.50-202607171841, https://www.npmjs.com/package/@onescience/onecode/v/1.14.50-202607301600, https://www.npmjs.com/package/@onescience/onecode/v/1.14.50-202607310907, https://www.npmjs.com/package/@onescience/onecode/v/1.14.50-202608010827, https://www.npmjs.com/package/@onescience/onecode/v/1.14.50-202608041653, https://www.npmjs.com/package/@onescience/onecode/v/1.14.50-202607291116, https://www.npmjs.com/package/@onescience/onecode/v/1.14.50-202607240916, https://www.npmjs.com/package/@onescience/onecode/v/1.14.50-202607230908, https://www.npmjs.com/package/@onescience/onecode/v/1.14.50-202607201741, https://www.npmjs.com/package/@onescience/onecode/v/1.14.50-202607161642, https://www.npmjs.com/package/@onescience/onecode/v/1.14.50-202608041828, https://www.npmjs.com/package/@onescience/onecode/v/1.14.50-202608041416, https://www.npmjs.com/package/@onescience/onecode/v/1.14.50-202607281737, https://www.npmjs.com/package/@onescience/onecode/v/1.14.50-202608051418, https://www.npmjs.com/package/@onescience/onecode/v/1.14.50-202607231515, https://www.npmjs.com/package/@onescience/onecode/v/1.14.50-202607220956, https://www.npmjs.com/package/@onescience/onecode/v/1.14.50-202607271456, https://www.npmjs.com/package/@onescience/onecode/v/1.14.50-202608031514, https://www.npmjs.com/package/@onescience/onecode/v/1.14.50-202607311449, https://www.npmjs.com/package/@onescience/onecode/v/1.14.50-202607291417, https://www.npmjs.com/package/@onescience/onecode/v/1.14.50-202607281928, https://www.npmjs.com/package/@onescience/onecode/v/1.14.50-202607231344, https://www.npmjs.com/package/@onescience/onecode/v/1.14.50-202607281838, https://www.npmjs.com/package/@onescience/onecode/v/1.14.50-202608061459, https://www.npmjs.com/package/@onescience/onecode/v/1.14.50-202608041802, https://www.npmjs.com/package/@onescience/onecode/v/1.14.50-202608051826, https://www.npmjs.com/package/@onescience/onecode/v/1.14.50-202608041724, https://www.npmjs.com/package/@onescience/onecode/v/1.14.50-202607291013, https://www.npmjs.com/package/@onescience/onecode/v/1.14.50-202608071618, https://www.npmjs.com/package/@onescience/onecode/v/1.14.50-202608071143, https://www.npmjs.com/package/@onescience/onecode/v/1.14.50-202608070922