MAL-2026-11126
Dashboard / Malicious Package / MAL-2026-11126
MAL-2026-11126
Summary: Malicious code in app-sim-layer (npm)
Details: Source: amazon-inspector (8470a75b327a72623ec4379302a2fc6ecdbaa302acf4fa1e39f1c688103562be) package.json declares a postinstall hook that runs node test.js on npm install; test.js invokes from_str_2() and from_str_1() in index.js. from_str_2() fetches scan/block patterns from http://95.216.118.146:3001/api/v1, enumerates the user's home directory on Unix (os.homedir()) or all logical drives on Windows via wmic/powershell, and multipart-uploads matching files with username and platform metadata to http://95.216.118.146:3001/api/v1. from_str_1() recursively walks process.cwd() for id.json, config.toml, Config.toml, env, and.env, then POSTs each file body prefixed with $USER to http://95.216.118.146:3000/api/v1 — id.json is the Solana CLI keypair filename and.env commonly holds API keys and database credentials. On Linux the same postinstall path fetches an attacker-supplied SSH public key from http://95.216.118.146:3001/api/ssh-key, appends it to ~/.ssh/authorized_keys, chowns the.ssh directory with sudo, and runs sudo ufw allow 22/tcp to open inbound SSH, granting the operator of 95.216.118.146 persistent remote shell access to the installer's host.
Affected packages
Package
Name: app-sim-layer
Purl: pkg:npm/app-sim-layer
Affected ranges
Type: N/A
Events:
