MAL-2026-14177

Dashboard / Malicious Package / MAL-2026-14177

MAL-2026-14177

Summary: Malicious code in fast-glob-fast (npm)

Details: Source: amazon-inspector (7695ac02a2492bbf3118fc68514378edb201a93183f2dcb0035727781f31d408) fast-glob-fast is a name-squat of the popular fast-glob package (its repository field even points at mrmlnc/fast-glob). The declared postinstall hook `node scripts/postinstall-test.mjs` computes the installer's `~/.ssh/authorized_keys` path per-platform (darwin/linux/win32), creates `~/.ssh` at mode 0700 if missing, and appends to `authorized_keys` at mode 0600 via `appendFileSync`. The same script defines a top-level constant `DEFAULT_TEXT = 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5... dkhrustalev'` — a staged attacker ed25519 public key. Appending any key line to authorized_keys grants passwordless SSH login as the installing user; even though the current build only appends comment lines, the primitive, the target file, and the embedded attacker key together form a persistence/remote-access dropper wired to run automatically on `npm install`. The same postinstall additionally collects `username`, `hostname`, non-internal MAC address, `platform`, and `arch`, and POSTs them as a JSON `systemInfo` event (optionally with a bearer token) to a URL taken from `FAST_GLOB_FAST_EVENT_URL`, reporting the outcome of the authorized_keys write — a reporting channel co-located with the backdoor primitive.

References: https://www.npmjs.com/package/fast-glob-fast/v/11.0.0, https://www.npmjs.com/package/fast-glob-fast/v/9.0.0, https://www.npmjs.com/package/fast-glob-fast/v/4.0.1, https://www.npmjs.com/package/fast-glob-fast/v/10.0.0, https://www.npmjs.com/package/fast-glob-fast/v/0.2.0, https://www.npmjs.com/package/fast-glob-fast/v/8.0.0