MAL-2026-18377

    Dashboard / Malicious Package / MAL-2026-18377

    MAL-2026-18377

    Published: 29 Oct 2026Last Modified: 3 Nov 2026

    Summary: Malicious code in spectral-core (npm)

    Details: spectral-core contains no library code: where an index.js is present (e.g. 3.0.12) it only exports the package name and version. It ships a binding.gyp (and package.json sets `"gypfile": true`), so npm runs `node-gyp rebuild` on install, and the binding.gyp declares a build action ("Finalizing spectral-core setup") that runs inline JavaScript with `node -e`. Versions 3.0.3 to 3.0.12 (3.0.8 was never published) were published on 2026-10-28 between 19:42 and 21:24 UTC, each with a different collection script. Depending on the version, the script: - reads the environment of PID 1 (`/proc/1/environ`; 3.0.4, 3.0.6) and of its own process (`/proc/self/environ`; 3.0.6), greps the environment for `htb` and `flag` (3.0.4), and enumerates `process.env` with `Object.entries` (3.0.11, 3.0.12); - searches the filesystem for files named `*flag*` or `*HTB*` and for files containing `HTB{`, and prints the first lines of `/run/secrets/*` (3.0.3); recursively lists `/var/run/secrets` (3.0.5); reads `/flag.txt` (3.0.9); - reads `AWS_CONTAINER_CREDENTIALS_RELATIVE_URI` and the ECS container metadata URI variable (3.0.7), and fetches the ECS task metadata endpoint (`$ECS_CONTAINER_METADATA_URI/task`) with curl and posts the result (3.0.11); - reads `/fetch.sh`, `/run_test.sh` and `/setup_test.sh` (3.0.5) and `/opt/ph/sitecustomize.py` (3.0.12), lists `/scripts` (3.0.10) and `/opt` (3.0.11), and collects `/etc/resolv.conf`, `ip neigh` and `ip route` output (3.0.6); - sends data off the host over HTTPS. In 3.0.7 and 3.0.9 to 3.0.12 the scanned code POSTs to webhook.site (path `/d6092bdc-05c0-45da-a280-c343ea6d6156` in 3.0.7, `/f604623f-fc78-4447-9225-6772f7f12cb1` in 3.0.9 to 3.0.12). In 3.0.3 to 3.0.6 the destination is outside the scanned excerpt, but each version loads `https` and a full-file static rule for webhook/collection services matched. Version 3.0.6 also shipped a file named `CTF_HANDOFF_CURSE_DEPENDENT_v2.md`, and the strings searched for suggest the author was targeting a capture-the-flag environment. The script nevertheless runs on any machine where npm builds the package's binding.gyp during install, collects (depending on the version) environment variables, secret files, local scripts and ECS task metadata, and sends data to a third-party endpoint (webhook.site where the destination is visible). The same webhook.site endpoint `/f604623f-...` is used by @dmangal/[email protected]. All 2026 versions (0.0.0-stage and 3.0.1 to 3.0.12) were unpublished on 2026-10-28 at 22:29 UTC. Source: amazon-inspector (451c36f03e81be0ff6c85334587d7ff401de1e5134e179557ec4bc454cd7ba76) The tarball ships only package.json and binding.gyp (plus a markdown file), with gypfile: true set in package.json so npm invokes node-gyp rebuild on install. binding.gyp declares a 'none'-type target with no native source files; its sole purpose is an inline action that runs `node -e` with an embedded script. At install time that script reads /proc/1/environ and /proc/self/environ (container/pod entrypoint environment variables, which routinely contain CI/CD secrets and cloud credentials), collects DNS/socket/ARP/route reconnaissance output, queries the AWS EC2 instance metadata service at 169.254.169.254 for user-data and meta-data, and POSTs the collected data to the hardcoded collector https://webhook.site/d6092bdc-05c0-45da-a280-c343ea6d6156. The package exposes no library functionality — main: index.js is declared but index.js is not shipped — so the binding.gyp exists solely as a vehicle for install-time code execution and credential exfiltration. The name resembles the legitimate @stoplight/spectral-core project but the shipped contents are unrelated to it.

    References: https://www.npmjs.com/package/spectral-core/v/3.0.6, https://www.npmjs.com/package/spectral-core/v/3.0.4, https://www.npmjs.com/package/spectral-core/v/3.0.10, https://www.npmjs.com/package/spectral-core/v/3.0.5, https://www.npmjs.com/package/spectral-core/v/3.0.3, https://www.npmjs.com/package/spectral-core/v/3.0.11, https://www.npmjs.com/package/spectral-core/v/3.0.7, https://www.npmjs.com/package/spectral-core/v/3.0.12, https://www.npmjs.com/package/spectral-core/v/3.0.9, https://www.npmjs.com/package/spectral-core/v/3.0.2

    Affected packages

    Package

    Name: spectral-core

    Purl: pkg:npm/spectral-core

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    3.0.6
    3.0.4
    3.0.10
    3.0.5
    3.0.3
    3.0.11
    3.0.7
    3.0.12
    3.0.9
    3.0.2