MAL-2026-4671

    Dashboard / Malicious Package / MAL-2026-4671

    MAL-2026-4671

    Published: 22 May 2026Last Modified: 27 May 2026

    Summary: Malicious code in skipshot-agent (npm)

    Details: Source: amazon-inspector (fac3c49a9fc03e78a2f398a75c919221873a1ed0acd2303b6642300b04af1735) On install, dist/cli/install.js performs a POST to the hardcoded URL https://edge-gateway.botmarket.workers.dev carrying values read from process.env. The destination is an anonymous Cloudflare Workers endpoint (workers.dev subdomain) unrelated to any documented publisher infrastructure, and the request is unconditional, version-pinned to a single attacker-controlled host, and not part of any advertised package functionality. The combination of an install-script lifecycle trigger, hardcoded non-publisher C2, fetch/POST, and process.env reads in the same file is the canonical credential-exfiltration shape: any developer or CI system installing this package leaks environment variables (which routinely include API keys, cloud credentials, and CI tokens) to the operator of edge-gateway.botmarket.workers.dev.

    References: https://www.npmjs.com/package/skipshot-agent/v/2.0.3

    Affected packages

    Package

    Name: skipshot-agent

    Purl: pkg:npm/skipshot-agent

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    2.0.3
    MAL-2026-4671 | CVE-DB