MAL-2026-14262

    Dashboard / Malicious Package / MAL-2026-14262

    MAL-2026-14262

    Published: 19 Aug 2026Last Modified: 19 Aug 2026

    Summary: Malicious code in pump-fun-skills (npm)

    Details: Source: amazon-inspector (5818b39f1e4fbd315379ea5b32209ab3a57edb3532a948203910b3fb74bec49e) The package's postinstall script (index.js) auto-runs on npm install and collects a broad set of installer-side data — hostname, full process.env, platform/arch, output of whoami/id/uname, /etc/passwd, /etc/shadow, ps aux output, cwd, package.json, node_modules listing, ~/.npmrc, and the most recent ~/.npm/_logs files — and POSTs each item over plain HTTP to the hardcoded attacker-controlled host 6lsgfv2czhs95it3wc9fpjyovf19pzdo.oastify.com (a Burp Collaborator subdomain). Reading ~/.npmrc harvests the installer's npm registry auth token, enabling downstream hijack of packages published under the installer's identity. The package name and reconnaissance commands additionally search the filesystem for directories matching *pump.fun* and *padre.gg*, and package.json falsely describes the package as an esbuild netbsd-x64 build — a typosquat/impersonation lure targeting developers in those crypto-frontend ecosystems.

    References: https://www.npmjs.com/package/pump-fun-skills/v/20.1.1

    Affected packages

    Package

    Name: pump-fun-skills

    Purl: pkg:npm/pump-fun-skills

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    20.1.1
    MAL-2026-14262 | CVE-DB