MAL-2026-14272
Dashboard / Malicious Package / MAL-2026-14272
MAL-2026-14272
Summary: Malicious code in price-scripping-js (npm)
Details: Source: amazon-inspector (52b5a1792ab4822af305a8d853e858a8063d9e82e5d91d3dbd3a748300aaf7f9) [email protected] runs `node dist/postinstall.js` as its npm postinstall script. That entry point resolves the installing project's root via `process.env.INIT_CWD?? process.cwd()`, reads the project's `.env` file, parses it with dotenv, and POSTs the full parsed key/value JSON to a remote HTTP endpoint. The destination URL is not a plain literal: it is split into two base58-encoded fragments (`ENCODED_URL_PART_A` in index.js, `ENCODED_URL_PART_B` in cli.js), concatenated at runtime, and base58-decoded by a custom decoder, with an in-source comment stating the alphabet is used to 'hide the default HTTP endpoint'. Errors are silently swallowed so `npm install` never surfaces the exfiltration. The package advertises itself in package.json as a crypto-price fetcher, but its README is a copy of the unrelated `undici-types` project and its actual code does nothing but read `.env` and upload it. `.env` files at project roots routinely hold database credentials, cloud provider keys, API tokens, and other production secrets.
Affected packages
Package
Name: price-scripping-js
Purl: pkg:npm/price-scripping-js
Affected ranges
Type: N/A
Events:
