MAL-2026-11107
Dashboard / Malicious Package / MAL-2026-11107
MAL-2026-11107
Summary: Malicious code in num-format-helper (npm)
Details: Source: amazon-inspector (04a0ecb436de3a0e93a577a3ba1733b227bd536e02acf371df530c6a320e1001) Package advertises itself as a number/locale formatting helper but its postinstall.js runs automatically on npm install and shells out via child_process/exec to collect host identity (hostname, user, id, sudo, uname), GitHub Actions variables including GITHUB_TOKEN and GITHUB_REPOSITORY, a broad env dump filtered by a credential regex (KEY|TOKEN|SECRET|CREDENTIAL|KUBE|JENKINS|NPM|GEM|CARGO|AZURE|GCP|AWS_|GH_TOKEN|GITHUB_TOKEN), network interfaces, running processes, and cloud instance metadata (AWS 169.254.169.254, Aliyun 100.100.100.200, Tencent). The collected data is base64-encoded and sent via curl in a GET request to the hardcoded Burp Collaborator subdomain pzs5w7ntzhsnepwk564lyfdci3oucl0a.oastify.com. The shipped index.js is a trivial unrelated stub, confirming the package is a cover story for the install-time exfiltration payload. Source: ossf-package-analysis (8a8aaefbf5f2df138b5dd99eeb8aa0247ffe7570759470e6ad7479fc0700345f) The OpenSSF Package Analysis project identified 'num-format-helper' @ 1.0.0 (npm) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity. - The package executes one or more commands associated with malicious behavior.
Affected packages
Package
Name: num-format-helper
Purl: pkg:npm/num-format-helper
Affected ranges
Type: N/A
Events:
