MAL-2026-14036

    Dashboard / Malicious Package / MAL-2026-14036

    MAL-2026-14036

    Published: 14 Aug 2026Last Modified: 14 Aug 2026

    Summary: Malicious code in notafollower1226 (npm)

    Details: Source: amazon-inspector (fdc72e98071e37ff58c3bb327f995c9c586b81a22180a8004b6564026cbc629f) The package.json postinstall script auto-executes on npm install. It queries the ECS container metadata endpoint (ECS_CONTAINER_METADATA_URI_V4/task) to collect the Task ARN, container image list, and log group/stream configuration, then enumerates process.env for keys matching /owner|team|user|created|author|maintainer|contact/i, and pipes the resulting report via `curl -X POST --data-binary @-` to the hardcoded anonymous ngrok tunnel https://mourner-slot-explicit.ngrok-free.dev. The destination is not associated with any declared publisher and ngrok-free.dev subdomains are ephemeral anonymous tunnels typical of supply-chain reconnaissance against CI/build infrastructure. The package ships no other functionality consistent with a legitimate declared purpose; its only install-time effect is the exfiltration beacon.

    References: https://www.npmjs.com/package/notafollower1226/v/1.0.3, https://www.npmjs.com/package/notafollower1226/v/1.0.5, https://www.npmjs.com/package/notafollower1226/v/1.0.2, https://www.npmjs.com/package/notafollower1226/v/1.0.1, https://www.npmjs.com/package/notafollower1226/v/1.0.0, https://www.npmjs.com/package/notafollower1226/v/1.0.4

    Affected packages

    Package

    Name: notafollower1226

    Purl: pkg:npm/notafollower1226

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.3
    1.0.5
    1.0.2
    1.0.1
    1.0.0
    1.0.4
    MAL-2026-14036 | CVE-DB