MAL-2026-11537

    Dashboard / Malicious Package / MAL-2026-11537

    MAL-2026-11537

    Published: 4 Aug 2026Last Modified: 4 Aug 2026

    Summary: Malicious code in discord-vibegrations-api-natives (npm)

    Details: Source: amazon-inspector (9cb64ecc29aa68ec4659bab280f4ffd2c3de889cc966c0974f85b0c488edc603) On npm install, the package's postinstall.js opens a TCP socket to 5.tcp.eu.ngrok.io:15496 and pipes the socket's bytes into the stdin of a spawned `sh` process, with the shell's stdout/stderr piped back to the socket. The package.json declares `"postinstall": "node postinstall.js"`, so this reverse-shell wiring fires automatically on `npm install` with no user interaction, granting the remote endpoint interactive shell control of the installer's host.

    References: https://www.npmjs.com/package/discord-vibegrations-api-natives/v/1.0.5

    Affected packages

    Package

    Name: discord-vibegrations-api-natives

    Purl: pkg:npm/discord-vibegrations-api-natives

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.5
    MAL-2026-11537 | CVE-DB