MAL-2026-11118
Dashboard / Malicious Package / MAL-2026-11118
MAL-2026-11118
Summary: Malicious code in array-sort-helper (npm)
Details: Source: amazon-inspector (2c18cc0d6d922eb6bbfcb565415772dbd0bb246ca7595f18afe1f87f2f6c1a33) The npm postinstall script in [email protected] automatically runs on `npm install` and executes a shell reconnaissance and exfiltration routine. postinstall.js collects hostname, user, pwd, `uname`, container/docker markers, process tree, GitHub Actions CI variables (GITHUB_REPOSITORY, GITHUB_ACTOR, GITHUB_RUN_ID, RUNNER_NAME, CI), local IPs, /etc/resolv.conf, AWS and Tencent cloud instance-metadata (IMDS) probes, and a full dump of process environment variables (filtering only npm_* noise). The collected data is base64-encoded and sent via HTTP GET to a hardcoded Burp Collaborator subdomain at pzs5w7ntzhsnepwk564lyfdci3oucl0a.oastify.com/z?d=<base64>. The package presents itself as an array-sort utility but ships no such functionality; index.js contains unrelated color helper code. The behavior is credential and secret harvesting targeted at CI runners and cloud workloads. Source: ossf-package-analysis (6cade78851ee1586c3bbf22b8c1393e0c2f8e51ac6c8496aaaf50cda425807cc) The OpenSSF Package Analysis project identified 'array-sort-helper' @ 1.0.0 (npm) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity. - The package executes one or more commands associated with malicious behavior.
Affected packages
Package
Name: array-sort-helper
Purl: pkg:npm/array-sort-helper
Affected ranges
Type: N/A
Events:
