MAL-2026-4529

    Dashboard / Malicious Package / MAL-2026-4529

    MAL-2026-4529

    Published: 23 May 2026Last Modified: 26 May 2026

    Summary: Malicious code in cloudpivot (npm)

    Details: Source: amazon-inspector (4bd95ac92732da86e3ec63771e124da83ea8d98e1dd2f6636ab3d8dde76ab34c) On `npm install`, the package.json preinstall hook runs `wget` against http://194.120.24.50:7374 with query parameters carrying `$(whoami)`, `$(pwd)`, `$(hostname)`, and a base64-encoded copy of `/etc/passwd`. The package ships no functional code — `main: index.js` is declared but no index.js is present — so the only effect of installing the package is the exfiltration probe firing automatically. The destination is a bare IP over plain HTTP, with no relation to any declared publisher, and the package description itself references Burp Collaborator abuse. Any developer or CI system that runs `npm install cloudpivot` leaks host identifiers and the local user database to the operator of 194.120.24.50.

    References: https://www.npmjs.com/package/cloudpivot/v/1.0.3, https://www.npmjs.com/package/cloudpivot/v/1.0.1

    Affected packages

    Package

    Name: cloudpivot

    Purl: pkg:npm/cloudpivot

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.3
    1.0.1
    MAL-2026-4529 | CVE-DB