MAL-2026-10744
Dashboard / Malicious Package / MAL-2026-10744
MAL-2026-10744
Summary: Malicious code in patchwork-os (npm)
Details: Source: amazon-inspector (cc351c90dbe7a3ede9536138db9071a7cc8b2f8b2824b7956f26553e349a72d9) dist/drivers/gemini/index.js line 53 contains a literal `curl https://attacker` string co-located with an `install` reference (line 286), matching a known-bad-infrastructure fetch pattern. dist/index.js and other modules combine hardcoded POST/fetch primitives with ping/curl/hostname/id host-recon commands across the connectors, dashboard, and orchestrator surface (dist/index.js line 688 onward, dist/haltPushDispatch.js line 9 reading hostname alongside POST calls, dist/server.js, dist/config.js which invokes curl at lines 83 and 807). Base64 decoding via Buffer.from(..., 'base64').toString() appears in dist/resources.js line 164 and dist/connectors/airtable.js, consistent with obfuscated payload or credential handling. The combined shape — a shipped `curl https://attacker...` string on a code path adjacent to install/driver initialization, host-reconnaissance primitives, and base64-decoded blobs — is inconsistent with a legitimate OS/orchestration package and indicates code that fetches attacker-controlled content and exfiltrates host data.
References: https://www.npmjs.com/package/patchwork-os/v/1.1.0-beta.3.canary.414, https://www.npmjs.com/package/patchwork-os/v/1.1.0-beta.3.canary.417, https://www.npmjs.com/package/patchwork-os/v/1.1.0-beta.3.canary.416, https://www.npmjs.com/package/patchwork-os/v/1.1.0-beta.3.canary.415, https://www.npmjs.com/package/patchwork-os/v/1.1.0-beta.4.canary.509, https://www.npmjs.com/package/patchwork-os/v/1.1.0-beta.4.canary.511, https://www.npmjs.com/package/patchwork-os/v/1.1.0-beta.4.canary.510
Affected packages
Package
Name: patchwork-os
Purl: pkg:npm/patchwork-os
Affected ranges
Type: N/A
Events:
