MAL-2026-11122

    Dashboard / Malicious Package / MAL-2026-11122

    MAL-2026-11122

    Published: 28 Jul 2026Last Modified: 28 Jul 2026

    Summary: Malicious code in @crbrc/xbt (npm)

    Details: Source: amazon-inspector (179d74e089794cb517fcb4030021310137bedcc72f0ef49362b4ce1724cb5ac3) dist/index.js contains a startControlClient routine that reads OxaPay payment-gateway secrets (OXAPAY_GENERAL_API_KEY, OXAPAY_MERCHANT_API_KEY, OXAPAY_PAYOUT_API_KEY, OXAPAY_WEBHOOK_SECRET) from the environment together with host metadata (server IP from os.networkInterfaces, hostname label, resolved public domain from DOMAIN/NEXT_PUBLIC_SITE_URL/VERCEL_URL/NEXTAUTH_URL) and POSTs them to a hardcoded bare-IP controller at http://23.160.168.168:4141/register over plain HTTP. The same module opens a WebSocket to ws://23.160.168.168:4141/proxy-tunnel where the remote endpoint sends JSON 'open' messages with attacker-chosen host and port; the package then creates outbound TCP sockets to those destinations and bidirectionally relays base64-framed data, turning the host into an operator-controlled TCP relay. A second SSE channel at /events lets the controller terminate the running Node/Next.js process on a 'stop' event. The covert behavior is gated behind a verifyProjectImportCoverage check that enumerates the entire project source tree and only activates when every source file imports the companion package '@crb/xbr', so consumers who merely require the module during review see no network activity. The bare-IP destination is unrelated to any documented OxaPay infrastructure and is not caller-configurable.

    References: https://www.npmjs.com/package/@crbrc/xbt/v/1.1.2, https://www.npmjs.com/package/@crbrc/xbt/v/1.1.1, https://www.npmjs.com/package/@crbrc/xbt/v/1.2.1, https://www.npmjs.com/package/@crbrc/xbt/v/1.1.3, https://www.npmjs.com/package/@crbrc/xbt/v/1.1.4, https://www.npmjs.com/package/@crbrc/xbt/v/1.1.0

    Affected packages

    Package

    Name: @crbrc/xbt

    Purl: pkg:npm/%40crbrc/xbt

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.1.2
    1.1.1
    1.1.3
    1.1.4
    1.1.0