MAL-2026-11498

Dashboard / Malicious Package / MAL-2026-11498

MAL-2026-11498

Summary: Malicious code in @custombots/custombot (npm)

Details: Source: amazon-inspector (b88fd82e9d147a4fad43b89bab0b975fe57714abf16356eb39ec0ae62dcc7949) index.js opens a TCP connection to a base64-obfuscated IP address (decodes to 85.137.253.124:1111), spawns /bin/sh, and pipes the shell's stdin/stdout/stderr through the socket, giving the remote endpoint an interactive shell on the installer's host. package.json declares "postinstall": "node install.js"; install.js uses node-linux's Service API to install index.js as a Linux systemd service named CustomBot and starts it, aborting unless run as root and prompting the user to run `sudo npm i`. The combination provides remote code execution against the installer with root privileges and reboot persistence. The C2 IP is stored as the base64 literal 'ODUuMTM3LjI1My4xMjQ=' and decoded at runtime, consistent with deliberate concealment. Source: ossf-package-analysis (07c87d7c1e7e788959af6de895c76293fd0922dd1a422da325962de7f8d3d19a) The OpenSSF Package Analysis project identified '@custombots/custombot' @ 1.0.0 (npm) as malicious. It is considered malicious because: - The package executes one or more commands associated with malicious behavior.

References: https://www.npmjs.com/package/@custombots/custombot/v/1.0.0, https://www.npmjs.com/package/@custombots/custombot/v/2.0.1, https://www.npmjs.com/package/@custombots/custombot/v/2.0.2, https://www.npmjs.com/package/@custombots/custombot/v/2.0.0