⌘ + K

MAL-2026-13986

Dashboard / Malicious Package / MAL-2026-13986

MAL-2026-13986

Published: 13 Aug 2026Last Modified: 13 Aug 2026

Summary: Malicious code in notafollower (npm)

Details: Source: amazon-inspector (e076dd548fea7ce80a77e7810b30c0a5d95c0b6ae4bf3d929281da70dbec1768) [email protected] declares preinstall and postinstall lifecycle scripts that run inline Node code targeting the AWS EC2 Instance Metadata Service. The scripts request an IMDSv2 token from 169.254.169.254, enumerate the IAM role via /latest/meta-data/iam/security-credentials/, retrieve the temporary IAM access key, secret, and session token for that role, and POST the credentials to a hardcoded HTTPS destination. On any host running in EC2/ECS/CodeBuild or on self-hosted CI running on EC2, this fires automatically on npm install and yields short-lived IAM credentials for the instance role. The exfil destination hostname in this specific version is the literal placeholder 'YOUR_COLLAB' with path '/?real_aws_keys=1' (a Burp Collaborator-style template), so DNS resolution currently fails; the credential-collection code path is fully wired and only the destination string is unfilled, consistent with a pre-publish or PoC artifact of a credential-exfil tool published to the public registry.

Affected packages

Package

Name: notafollower

Purl: pkg:npm/notafollower

Affected ranges

Type: N/A

Events:

Introduced- None

Fixed -None

Affected versions

1.0.3

1.0.11

1.0.8

1.0.9

1.0.0

1.0.2

1.0.1

1.0.5

1.0.4

1.0.10

1.0.6

1.0.7