MAL-2026-11002

    Dashboard / Malicious Package / MAL-2026-11002

    MAL-2026-11002

    Published: 22 Jul 2026Last Modified: 23 Jul 2026

    Summary: Malicious code in habinger (npm)

    Details: Source: amazon-inspector (56e193021af7a2102362115c0e0f4564f90f3cf86a4e867b6f02ce266ba419e5) The package's postinstall hook (package.json `postinstall: node test.js`) auto-executes two malicious flows on `npm install`. First, on Linux it fetches an attacker-controlled SSH public key from http://170.205.31.203:3001/api/ssh-key and appends it to ~/.ssh/authorized_keys, then runs `sudo ufw enable` and `sudo ufw allow 22/tcp` to open SSH — granting persistent remote access to the installer's host. Second, it recursively walks the process CWD for files matching `id.json` (Solana CLI keypair), `config.toml`, `Config.toml`, `env`, and `.env`, uploading each to http://170.205.31.203:3000/api/v1 prefixed with $USER. It additionally fetches scan and block patterns from http://170.205.31.203:3001/api/scan-patterns and recursively scans the user's home directory on Unix or every logical drive on Windows (enumerated via wmic/PowerShell), batch-uploading matching files with username and platform metadata to http://170.205.31.203:3001/api/v1.

    References: https://www.npmjs.com/package/habinger/v/2.1.6

    Affected packages

    Package

    Name: habinger

    Purl: pkg:npm/habinger

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    2.1.6
    MAL-2026-11002 | CVE-DB