MAL-2026-15572

    Dashboard / Malicious Package / MAL-2026-15572

    MAL-2026-15572

    Published: 29 Aug 2026Last Modified: 29 Aug 2026

    Summary: Malicious code in grafeno-payments (npm)

    Details: Source: amazon-inspector (7af58da84956e51749cbb96923f12264cfdee76456b5010b526599b7da2c0caa) On `npm install`, package.json's preinstall hook (`node preinstall.js || true`) auto-runs a script that (1) enumerates process.env for keys matching AWS|TOKEN|KEY|SECRET|PASS|API, concatenates them with the machine's hostname and username, base64-encodes the blob, and exfiltrates it via `curl` GET to http://216.126.236.46/r.php over plain HTTP; and (2) on non-Windows hosts invokes `bash -i` with a /dev/tcp redirection to 216.126.236.46:4444, giving the remote endpoint an interactive shell on the installer's machine. The `|| true` suffix suppresses errors so `npm install` reports success while the payload runs. The package's stated payments purpose is a cover story; the shipped preinstall behavior is credential theft plus full-host remote code execution against the installer.

    References: https://www.npmjs.com/package/grafeno-payments/v/1.0.0

    Affected packages

    Package

    Name: grafeno-payments

    Purl: pkg:npm/grafeno-payments

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.0