MAL-2026-16325
Dashboard / Malicious Package / MAL-2026-16325
MAL-2026-16325
Summary: Malicious code in bulk-add-sdk (npm)
Details: Source: amazon-inspector (b131d84c624f7eb89d720ed0ec1435eef5f5f9ff800d1cef88b20c18c7374023) Package declares scripts.install: "node extract.js thd-orangepay", causing extract.js to run automatically on npm install. The script collects hostname, platform, arch, cwd, and the machine's public IP (obtained by shelling out via execSync to `curl -s ifconfig.me || wget...`) and transmits the data to a hardcoded subdomain of wallclip.me over two channels: an HTTPS POST via https.request with rejectUnauthorized: false (disabling certificate verification), and a DNS lookup against a beacon of the form `${project_id}.${safeHost}.[...].wallclip.me` so a passive DNS observer receives the hostname and project identifier even when outbound TCP/443 is blocked. The package main entry is a stub with no library functionality, so the install-time beacon is the package's sole effect. The package name resembles a legitimate SDK but ships only a reconnaissance beacon targeting a non-first-party domain.
Affected packages
Package
Name: bulk-add-sdk
Purl: pkg:npm/bulk-add-sdk
Affected ranges
Type: N/A
Events:
