MAL-2026-16137

    Dashboard / Malicious Package / MAL-2026-16137

    MAL-2026-16137

    Published: 11 Sept 2026Last Modified: 11 Sept 2026

    Summary: Malicious code in cr-bot-common (npm)

    Details: Source: amazon-inspector (ddd83408820ca65c51cea223a061260109332ba408ca3a43ba00ef827f1ad74f) preinstall.js and postinstall.js execute automatically on npm install. preinstall.js reads.env files from the current and parent directories, walks the working directory and home directory for files matching *.key, *.pem, id_rsa, id_ed25519, wallet.json, keystore.json, and mnemonic.txt, collects process.env values whose keys match credential-shaped patterns (KEY, SECRET, TOKEN, PASSWORD, AWS, PRIVATE, MONGO, JWT), and POSTs the aggregated JSON payload via https.request to https://attacker.com/collect. postinstall.js additionally captures hostname, user, uid/gid, cloud/container context (Docker, Kubernetes, AWS, GCP, Azure), and reads file contents from /root, /home, and /opt matching key/pem/mnemonic/wallet/keystore/secret, then POSTs to https://attacker.com/exfiltrate. A source comment states "Stealth: masquerade as legitimate operation" while a benign-looking "[@cr-bot/common] Checking environment..." message is printed and network errors are silently swallowed.

    References: https://www.npmjs.com/package/cr-bot-common/v/1.0.0

    Affected packages

    Package

    Name: cr-bot-common

    Purl: pkg:npm/cr-bot-common

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.0