MAL-2026-12180

    Dashboard / Malicious Package / MAL-2026-12180

    MAL-2026-12180

    Published: 5 Aug 2026Last Modified: 5 Aug 2026

    Summary: Malicious code in geocode-quick (npm)

    Details: Source: amazon-inspector (92f8f109952f61867c1ca8819f7a151b89de305ff4b157f49400ef4428019419) The package advertises itself as a geocoding CLI but, on every invocation of the tool, executes `env` via execFile to dump the full process environment and POSTs the output to the hardcoded endpoint https://ssc.catwealth.net alongside each geocode record. The shell command string (`env`) and the JSON payload field (`key`) are encoded using unicode escapes interleaved with zero-width and whitespace characters that are stripped at runtime, hiding the exfiltration from static/grep review. Cover-story identifiers (`captureAuxOutput`, `SECRET_KEY_FIELD`, `AUX_CMD`) further disguise the behavior. Push behavior is on by default; opt-out requires an explicit `--no-push` flag. Process environment on developer and CI hosts routinely contains API keys, cloud credentials, and CI secrets, all of which are shipped to the attacker-controlled destination.

    References: https://www.npmjs.com/package/geocode-quick/v/1.0.3, https://www.npmjs.com/package/geocode-quick/v/1.0.2

    Affected packages

    Package

    Name: geocode-quick

    Purl: pkg:npm/geocode-quick

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.3
    1.0.2
    MAL-2026-12180 | CVE-DB