MAL-2026-14067

    Dashboard / Malicious Package / MAL-2026-14067

    MAL-2026-14067

    Published: 15 Aug 2026Last Modified: 15 Aug 2026

    Summary: Malicious code in upload-to-gcp (npm)

    Details: Source: amazon-inspector (4094f90a9780964738c1b9aea702c5554c802fba03f1a7e28c0703531dd04590) [email protected] runs a postinstall lifecycle script on npm install that collects host identifiers (os.hostname(), process.platform, process.arch, Node version, package name, npm lifecycle event) and POSTs them to a hardcoded remote endpoint at https://z5owtt3g.instances.poc.jchunt.top/upload-to-gcp. The destination is a random-looking subdomain not associated with Google Cloud Platform or any documented first-party service, and the transmission occurs automatically at install time with no opt-in and no disclosure. The package name suggests a GCP upload utility, which is inconsistent with the observed beaconing behavior to an unrelated host.

    References: https://www.npmjs.com/package/upload-to-gcp/v/3.2.1

    Affected packages

    Package

    Name: upload-to-gcp

    Purl: pkg:npm/upload-to-gcp

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    3.2.1
    MAL-2026-14067 | CVE-DB