MAL-2026-18375

Dashboard / Malicious Package / MAL-2026-18375

MAL-2026-18375

Summary: Malicious code in @dmangal/curse-dependent-ecto (npm)

Details: @dmangal/curse-dependent-ecto contains no library code (index.js in 99999.0.0 and 99999.0.2 only exports its name and version) and was published on 2026-10-28 between 21:59 and 22:19 UTC with inflated version numbers 99999.0.0 to 99999.0.2. It ships a binding.gyp (and package.json sets `"gypfile": true`), so npm runs `node-gyp rebuild` on install, and the binding.gyp declares a build action ("Finalizing ecto setup") that runs inline JavaScript with `node -e`. The script loads `child_process`, enumerates `process.env` (99999.0.0, 99999.0.1; found by a full-file static rule, the enumeration itself is outside the scanned excerpt), and POSTs data over HTTPS to webhook.site: path `/f604623f-fc78-4447-9225-6772f7f12cb1` in 99999.0.0 and `/89bd8fe7-328c-4e6d-970c-4d567b5a48a0` in 99999.0.1 and 99999.0.2. In 99999.0.2 the posted data is prefixed `SCOPED:` and the code that collects it is outside the scanned excerpt (it also defines an HTTP GET helper). The first endpoint is the same one used by spectral-core, whose version 3.0.6 shipped a file named `CTF_HANDOFF_CURSE_DEPENDENT_v2.md`; together with the package name this suggests a capture-the-flag context, but the script runs on any machine where npm builds the package's binding.gyp during install and sends host data, including an enumeration of its environment variables in 99999.0.0 and 99999.0.1, to a third-party endpoint. By 2026-10-29 00:04 UTC the registry returned 404 for the package metadata and for all three version archives. Source: amazon-inspector (28b6b5c8c100680386dbcbbd51dd409f67f0d54701eb0e50232934acc53bf397) The package's binding.gyp contains a GYP command-expansion action that is executed automatically by node-gyp during `npm install`. The embedded `node -e` script runs `grep -rl 'HTB{' /workspace/ /root/ /tmp/ /opt/ /var/ /etc/` across installer-side paths, reads /tmp/scent-trail.jsonl and /workspace/repo/package.json, enumerates every key of process.env and concatenates each key=value pair, and POSTs each of these payloads (prefixed GREP:, FILE:, ALLENV:) to the hardcoded attacker endpoint webhook.site/89bd8fe7-328c-4e6d-970c-4d567b5a48a0. The binding.gyp has no accompanying native source files; its only purpose is to run the embedded exfiltration command. The implausibly high version string (99999.0.1) is consistent with a dependency-confusion lure. Installing this package in a developer workstation or CI environment causes CI secrets, API tokens, and environment-injected credentials, along with workspace file contents and any file containing the HTB{ marker, to be transmitted to an attacker-controlled host.

References: https://www.npmjs.com/package/@dmangal/curse-dependent-ecto/v/99999.0.2, https://www.npmjs.com/package/@dmangal/curse-dependent-ecto/v/99999.0.1, https://www.npmjs.com/package/@dmangal/curse-dependent-ecto/v/99999.0.0