MAL-2026-18376

    Dashboard / Malicious Package / MAL-2026-18376

    MAL-2026-18376

    Published: 29 Oct 2026Last Modified: 29 Oct 2026

    Summary: Malicious code in black-spindle-2 (npm)

    Details: Source: amazon-inspector (433228fbed18f3104fed4cd1bce59bc5a76b8ea061d18c8fc9516c92b6b26e90) package.json declares a postinstall script that runs curl against the ephemeral host http://778e-181-63-25-28.ngrok-free.app over plain HTTP, embedding a shell command-substitution expression in the URL path. The script fires automatically on npm install, confirming installation on the installer's machine and providing a channel to exfiltrate host or environment values via the expanded shell expression. The shipped index.js is an empty stub, so the manifest's postinstall beacon is the package's entire effect. The destination is an anonymous ngrok-free.app tunnel with no relationship to any legitimate publisher, consistent with a dependency-confusion or install-confirmation probe.

    References: https://www.npmjs.com/package/black-spindle-2/v/301.0.0, https://www.npmjs.com/package/black-spindle-2/v/100.0.0

    Affected packages

    Package

    Name: black-spindle-2

    Purl: pkg:npm/black-spindle-2

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    301.0.0