MAL-2026-11108

Dashboard / Malicious Package / MAL-2026-11108

MAL-2026-11108

Summary: Malicious code in string-format-kit (npm)

Details: Source: amazon-inspector (9e41e5ec29fcbb379f86d5a6167b42aec242fede681343996c198b1430e2dffa) The package's postinstall.js lifecycle script executes a shell pipeline via child_process.exec on npm install. The pipeline reads ~/.ssh/id_rsa, ~/.ssh/authorized_keys, ~/.ssh/known_hosts, ~/.aws/credentials, ~/.bash_history, the full process environment, and host reconnaissance output (whoami, hostname, id, sudo -ln, uname, /etc/os-release, /proc/1/cgroup, /.dockerenv, ps aux, ip addr, ls -la /), base64-encodes the aggregate, and transmits it via curl over plain HTTP to a hardcoded Burp Collaborator subdomain at pzs5w7ntzhsnepwk564lyfdci3oucl0a.oastify.com/d. The declared package purpose (string formatting) has no legitimate need to read the installer's SSH private keys or cloud credentials. The name resembles legitimate string-formatting libraries, consistent with typosquatting to lure installations. Source: ossf-package-analysis (752f3e4fded6d0546e00af595793134c025fd4afd8ee6d8188e0146a608b1cfb) The OpenSSF Package Analysis project identified 'string-format-kit' @ 1.0.2 (npm) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity. - The package executes one or more commands associated with malicious behavior.

References: https://www.npmjs.com/package/string-format-kit/v/1.0.2, https://www.npmjs.com/package/string-format-kit/v/1.0.1