MAL-2026-16303

    Dashboard / Malicious Package / MAL-2026-16303

    MAL-2026-16303

    Published: 21 Sept 2026Last Modified: 21 Sept 2026

    Summary: Malicious code in @nimbusedge2/authxsas (npm)

    Details: Source: amazon-inspector (0146259024cc8ef3a174ff98571fe4af975b3eecf9184a0a5339d42808243d10) The package's package.json declares a preinstall script that fires unconditionally on `npm install`. The script uses curl to query the cloud instance metadata service via the nip.io wildcard-DNS resolver (169.254.169.254.nip.io/latest/meta-data/), base64-encodes the response, and POSTs it over plain HTTP to a hardcoded canarytokens.com endpoint (http://canarytokens.com/terms/7dc94zmd3so67n5vbz5bxmt7v/contact.php). On installers running on AWS/GCP/Azure hosts with IMDS reachable, this leaks IAM role identifiers and, on IMDSv1, temporary cloud credentials to a third-party canary endpoint at install time. The tarball ships no source files; the manifest and its preinstall hook are the entire payload. The scope name and package name are consistent with a dependency-confusion / SSRF canary probe targeting an internal namespace.

    References: https://www.npmjs.com/package/@nimbusedge2/authxsas/v/1.1.0

    Affected packages

    Package

    Name: @nimbusedge2/authxsas

    Purl: pkg:npm/%40nimbusedge2/authxsas

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.1.0