MAL-2026-4692

    Dashboard / Malicious Package / MAL-2026-4692

    MAL-2026-4692

    Published: 22 May 2026Last Modified: 26 May 2026

    Summary: Malicious code in thevoid (npm)

    Details: Source: amazon-inspector (0ce4d125de5d699da897d074134f8d1f0a971aa23d9c3d6ff3330015fccad091) On install, postinstall.js performs an HTTPS request to void-relay.com carrying process.env contents along with host identifiers (process.platform, process.arch). The destination is not associated with any documented publisher SDK or runtime CDN, and the data exfiltrated (full environment variables plus host fingerprint) constitutes installer-side secret leakage. This matches the canonical hardcoded-C2 exfiltration shape: a lifecycle script (postinstall.js line 38) issues https.get to a hardcoded attacker-controlled host (void-relay.com, line 22) with environment data attached. Any developer or CI runner that installs this package will leak its environment (which routinely contains API tokens, cloud credentials, and CI secrets) to the attacker.

    References: https://www.npmjs.com/package/thevoid/v/0.1.4, https://www.npmjs.com/package/thevoid/v/0.1.3

    Affected packages

    Package

    Name: thevoid

    Purl: pkg:npm/thevoid

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    0.1.4
    0.1.3
    MAL-2026-4692 | CVE-DB