MAL-2026-16330
Dashboard / Malicious Package / MAL-2026-16330
MAL-2026-16330
Summary: Malicious code in commerce-materials (npm)
Details: Source: amazon-inspector (bdfff371a76fd4cef2247de8c595a3981d58353391141b58a8ce31e03ec9da6d) [email protected] declares preinstall and postinstall lifecycle scripts that run callback.js on every npm install. callback.js collects hostname, username, platform, cwd, home directory, CI/cloud provider fingerprints, network interface addresses, and a filtered list of process.env variable names matching credential-shaped patterns (token, secret, key, password, aws, azure, gcp, npm, ssh, jwt). It also probes the current working directory for the presence of.env,.env.local,.env.production,.npmrc,.yarnrc, package-lock.json, yarn.lock,.git/config,.docker/config.json, credentials, and secrets.json. The assembled report is POSTed to api.telegram.org using a hardcoded bot token (8636277735) and chat_id (1064260758). A secondary DNS-based exfiltration channel base64-encodes host, user, and CI fields into a subdomain of dc-callback.example.com and issues dns.resolve queries, providing a fallback when HTTPS egress is filtered. The behavior fires automatically on npm install with no user interaction and no documented opt-in.
Affected packages
Package
Name: commerce-materials
Purl: pkg:npm/commerce-materials
Affected ranges
Type: N/A
Events:
