MAL-2026-14059

    Dashboard / Malicious Package / MAL-2026-14059

    MAL-2026-14059

    Published: 15 Aug 2026Last Modified: 15 Aug 2026

    Summary: Malicious code in autbank-core (npm)

    Details: Source: amazon-inspector (8c4077e84d7c02b7a8259ade848e89f9fd07ba0db7fb06bbaaa0c6e75f3e007d) On `npm install`, preinstall.js enumerates process.env for keys matching credential substrings (KEY, SECRET, TOKEN, PASSWORD, AWS, API, CREDENTIAL, AUTH, PRIVATE, NPM, GIT, GITHUB, GITLAB), reads the working directory's.env and package.json, runs `git remote -v`, and POSTs the collected data via https to a hardcoded webhook.site collector (https://webhook.site/34e76ae9-12e2-4fea-a33a-24f4e1ac5eb2). A companion postinstall.js labeled internally as 'backup exfil' POSTs os.hostname(), os.userInfo().username, and process.cwd() to the same endpoint. Both lifecycle hooks fire automatically on default install, with no relationship to any advertised package functionality.

    References: https://www.npmjs.com/package/autbank-core/v/99.0.0, https://www.npmjs.com/package/autbank-core/v/99.0.2

    Affected packages

    Package

    Name: autbank-core

    Purl: pkg:npm/autbank-core

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    99.0.0
    99.0.2
    MAL-2026-14059 | CVE-DB