⌘ + K

MAL-2026-10769

Dashboard / Malicious Package / MAL-2026-10769

MAL-2026-10769

Published: 17 Jul 2026Last Modified: 28 Jul 2026

Summary: Malicious code in easyway2 (npm)

Details: Source: amazon-inspector (fcfc1bc035f5239e384f9e32be4fc53cdffe065920da7c6181e42757d6b41195) On npm install, the package's postinstall hook executes index.js, which POSTs the installer's full process.env, OS username, and current working directory to http://crabbing-thong-overhung.ngrok-free.dev/v1/init over plain HTTP. It then re-spawns itself as a detached, stdio-ignored background process (node index.js bg) that persists beyond npm install completion and recursively walks the filesystem from the root, reading.env,.conf,.json,.yaml,.yml,.sql,.log,.txt,.js, and dotfiles. Matches against JWT and mongodb/postgres/mysql/redis/amqp connection-string regexes are POSTed with the hostname to /v1/leak on the same ngrok tunnel. The ngrok-free.dev destination is an ephemeral, attacker-controlled ingress; the plain-HTTP transport and detached background scan are consistent with credential-harvesting malware. Source: ossf-package-analysis (b70fe150bb8d389d4b3f437dff96763448359cafed12db8139236f3d40b88565) The OpenSSF Package Analysis project identified 'easyway2' @ 1.0.3 (npm) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity.

Affected packages

Package

Name: easyway2

Purl: pkg:npm/easyway2

Affected ranges

Type: N/A

Events:

Introduced- None

Fixed -None

Affected versions

1.0.3

1.0.7

1.0.11

1.0.0

1.0.8

1.0.2

1.0.6

1.0.5

1.0.10

1.0.1

1.0.9