MAL-2026-14372
Dashboard / Malicious Package / MAL-2026-14372
MAL-2026-14372
Summary: Malicious code in create-coin (npm)
Details: Source: amazon-inspector (d92da1d80f455caae769107e4b3ff99c003a296f1238728cfc5521d5be06c380) Package [email protected] registers a postinstall hook that runs build/payload.node.js during npm install. The script performs anti-analysis guards (bails out on CI/GitHub Actions env vars, /.dockerenv, container cgroups, or fewer than four environment variables), sleeps a randomized 10-30 seconds, then reads the installer's ~/.npmrc (or %USERPROFILE%\.npmrc), enumerates every process.env entry, and reads project files including package.json, package-lock.json,.env, and src/config.*. It also collects host reconnaissance via os.hostname(), os.userInfo(), and child_process output of uname/id, plus open localhost port probes. All collected data is POSTed over HTTPS to the hardcoded endpoint https://random-name.trycloudflare.com with rejectUnauthorized:false, and a.ran lock file is written for idempotency. Exceptions are swallowed and exit code is forced to 0 so npm install appears successful. The package.json description claims the package is a "netbsd-x64 build for esbuild" while the shipped code has no relationship to esbuild, indicating typosquat / platform-package impersonation of the esbuild family.
Affected packages
Package
Name: create-coin
Purl: pkg:npm/create-coin
Affected ranges
Type: N/A
Events:
