MAL-2026-11536

    Dashboard / Malicious Package / MAL-2026-11536

    MAL-2026-11536

    Published: 4 Aug 2026Last Modified: 4 Aug 2026

    Summary: Malicious code in discord-vibegrations-api-helpers (npm)

    Details: Source: amazon-inspector (e39dfe430611b304685f7a5e9b29ecd1661c5238bd2ed706e485e1d82540cfc6) The package declares a postinstall lifecycle hook (`postinstall: node postinstall.js`) that opens a TCP socket to 5.tcp.eu.ngrok.io:15496 and pipes it to a spawned `/bin/sh` process (client.pipe(sh.stdin); sh.stdout.pipe(client)). On `npm install`, this hands full interactive shell control of the installer's host to the remote endpoint, providing arbitrary code execution and a persistent backdoor for the duration of the tunnel. The ngrok dynamic-DNS tunnel is an attacker-controlled destination unrelated to any legitimate build behavior.

    References: https://www.npmjs.com/package/discord-vibegrations-api-helpers/v/1.0.0

    Affected packages

    Package

    Name: discord-vibegrations-api-helpers

    Purl: pkg:npm/discord-vibegrations-api-helpers

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.0
    MAL-2026-11536 | CVE-DB