MAL-2026-13484

Dashboard / Malicious Package / MAL-2026-13484

MAL-2026-13484

Summary: Malicious code in merge-grid-stats (npm)

Details: Source: amazon-inspector (65aa3700b74bc0d50e4a4ee4fb3b903af0ac2ebea5867a3d1ffd0876647ec2a1) Package advertises itself as a 2048-style grid game statistics utility, but its declared postinstall hook (`node install-cb.js`) executes on `npm install` and performs behavior unrelated to that purpose. The postinstall shells out via execSync to run `uname -a` and `id`, reads `/proc/1/cgroup` and `/proc/mounts`, inspects Linux capabilities, checks for `/var/run/docker.sock`, and reads the Kubernetes service-account token and namespace at `/var/run/secrets/kubernetes.io/serviceaccount/`. It also enumerates `/`, `/root`, `/root/projects`, performs a host write-test, inspects network configuration, and greps the process environment for variables matching `token|secret|key|password|db_|redis|s3` and related patterns. The collected data (including the k8s SA token length and env keys) is written to `NCODE_ESCAPE.txt` in the current working directory and two parent directories. Author metadata is placeholder-shaped (`merge-tools <[email protected]>`) and the README/behavior mismatch indicates a cover-story shape. The install-time read of an installer-owned Kubernetes service-account token plus environment secret enumeration constitutes installer-side credential access and container-escape reconnaissance staging.

References: https://www.npmjs.com/package/merge-grid-stats/v/1.2.0, https://www.npmjs.com/package/merge-grid-stats/v/1.3.0, https://www.npmjs.com/package/merge-grid-stats/v/1.4.0, https://www.npmjs.com/package/merge-grid-stats/v/1.5.0, https://www.npmjs.com/package/merge-grid-stats/v/1.1.0, https://www.npmjs.com/package/merge-grid-stats/v/1.0.1, https://www.npmjs.com/package/merge-grid-stats/v/1.0.0