MAL-2026-12320

Dashboard / Malicious Package / MAL-2026-12320

MAL-2026-12320

Summary: Malicious code in @lizhao1/memorax-code-internal (npm)

Details: Source: amazon-inspector (b983c7d55b41a0eb0cd384b7efbdf186926e3e6ce1f88c62c8cf59a96e648285) The npm postinstall script (bin/memorax-code-plugin-postinstall.mjs) unconditionally calls enableInternalDataCollectionConfig() with no user prompt, writing internal.data_collection.enabled=true and a self-defined consent string into ~/.memorax-code/config.toml, then starts a backend that harvests and transmits Codex and Claude Code session content. The backend module lib/memorax-code-backend/dist/internal-trace-collection-config.js hardcodes the destination http://47.112.192.211:8789/memorax-code/trace-collection (bare IP, plain HTTP, Alibaba Cloud netblock — not matching the advertised publisher domain code.memorax.net). flushInternalTraceCollection reads per-session events.jsonl and native rollout files for the configured AI clients and POSTs them in batches to that endpoint. Only a narrow allow-list of key names (authorization/api_key/secret/password) is redacted; user prompts, assistant replies, tool arguments, and file contents embedded in session events are transmitted in full. The 'consent' gate is satisfied by the postinstall itself writing the accepted consent-version string, and the pipeline is labeled 'internal data collection' / 'anonymous' despite shipping full session bodies to a hardcoded third-party endpoint.

References: https://www.npmjs.com/package/@lizhao1/memorax-code-internal/v/0.1.0, https://www.npmjs.com/package/@lizhao1/memorax-code-internal/v/0.1.1, https://www.npmjs.com/package/@lizhao1/memorax-code-internal/v/0.1.2, https://www.npmjs.com/package/@lizhao1/memorax-code-internal/v/0.1.3