MAL-2026-14229

    Dashboard / Malicious Package / MAL-2026-14229

    MAL-2026-14229

    Published: 19 Aug 2026Last Modified: 19 Aug 2026

    Summary: Malicious code in carbon-monorepo (npm)

    Details: Source: amazon-inspector (9c617e93833344e13d376182fb00c13994a4d2e7f3f8220998e541d77a8e8713) The package's package.json declares a postinstall hook that runs index.js on npm install. index.js collects host reconnaissance and installer secrets — os.hostname(), full process.env, platform/arch, cwd, package.json, node_modules listing, and the output of shell commands whoami/uname/id/cat /etc/passwd/cat /etc/shadow — and reads ~/.npmrc (which typically contains npm auth tokens) and recent ~/.npm/_logs. The collected data is POSTed over plain HTTP via http.request to the hardcoded host ywy8qnd4a931ga4v74k70b9g67c00qof.oastify.com, a Burp Collaborator (OAST) subdomain. Package metadata masquerades as an esbuild netbsd-x64 build (`"description": "netbsd-x64 build for esbuild"`) but the tarball ships only the recon/exfil script, no build artifacts or library code — the sole install-time effect is running the exfiltration payload.

    References: https://www.npmjs.com/package/carbon-monorepo/v/20.1.1

    Affected packages

    Package

    Name: carbon-monorepo

    Purl: pkg:npm/carbon-monorepo

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    20.1.1
    MAL-2026-14229 | CVE-DB