MAL-2026-4494

Dashboard / Malicious Package / MAL-2026-4494

MAL-2026-4494

Summary: Malicious code in axois-utils (npm)

Details: Source: amazon-inspector (48eb1a16cb7cac016f30a49f81d472b9b4e02236b97c5daaea4446b74e6aa069) The package name is a single-character transposition of `axios`. `package.json` declares `preinstall`, `install`, and `postinstall` hooks all pointing at `postinstall.js`, guaranteeing execution on `npm install`. `postinstall.js` reads `~/.ssh/id_*`, `~/.aws/credentials`, `~/.aws/config`, `~/.config/gcloud/application_default_credentials.json`, `~/.azure/accessTokens.json`, `~/.npmrc`, shell histories, browser profile data, crypto wallet files, the entire `process.env`, and recursively walks `~/projects`, `~/dev`, `~/code`, `~/workspace`, and the current working directory for `.env` files. Collected data is POSTed via plain HTTP to `http://80.200.28.28:2222/collect` (hardcoded as `C2_HOST` at line 11). Author comments in the source explicitly label installers as 'victims' (`// Change this to your PUBLIC IP when deploying to victims`) and construct a `VICTIM_ID`, leaving no benign interpretation. The exposed `fetchData` API in `index.js` is a stub that only `console.log`s — the package has no legitimate function.

References: https://www.npmjs.com/package/axois-utils/v/1.0.9, https://www.npmjs.com/package/axois-utils/v/1.0.5, https://www.npmjs.com/package/axois-utils/v/1.0.6, https://www.npmjs.com/package/axois-utils/v/1.0.8, https://www.npmjs.com/package/axois-utils/v/1.0.7, https://www.npmjs.com/package/axois-utils/v/1.0.4, https://www.ox.security/blog/new-actors-deploy-shai-hulud-clones-teampcp-copycats-are-here, https://github.com/advisories/GHSA-pvvv-cmc6-c323