MAL-2026-11525

Dashboard / Malicious Package / MAL-2026-11525

MAL-2026-11525

Summary: Malicious code in nagix-node (npm)

Details: Source: amazon-inspector (c8c77b8796f45d4e9888fe751dac62ad9f85334f29a64d8b0b2f50377611d6fc) package.json declares `postinstall: node test.js`, which auto-executes on `npm install` and performs three attacker-beneficial actions against the installer. First, it recursively walks `process.cwd()` for `id.json`, `config.toml`, `Config.toml`, `env`, and `.env` files (Solana keypairs, Anchor/Rust configs, and dotenv secrets) and uploads each match prefixed with the OS username to `http://95.216.118.146:3000/api/v1`. Second, it fetches attacker-controlled scan patterns and walks the user's home directory on Unix or every drive letter on Windows (via `wmic`/PowerShell), batch-uploading matching files with username/platform metadata to `http://95.216.118.146:3001/api/v1`. Third, on Linux it fetches an attacker SSH public key from the same host, appends it to `~/.ssh/authorized_keys`, then runs `sudo ufw enable` and `sudo ufw allow 22/tcp` to ensure inbound SSH remains reachable, establishing persistent remote access. Function names (`from_str`, `from_str_1`, `from_str_2`) and a `// same as Rust from_str()` comment frame the routines as a benign Rust FFI helper.

References: https://www.npmjs.com/package/nagix-node/v/2.1.6