MAL-2026-5571

    Dashboard / Malicious Package / MAL-2026-5571

    MAL-2026-5571

    Published: 11 Jun 2026Last Modified: 11 Jun 2026

    Summary: Malicious code in qa-handoff (npm)

    Details: Source: amazon-inspector (4939e56124668b7d03f9e2a96dfbfedba53e24aaa5d2190e298547e724b1f851) On `npm install`, the package automatically executes lib/_setup.js via the postinstall lifecycle hook. The script spawns a detached Node process that collects host identifiers (hostname, username, platform, architecture, IPv4 addresses, current working directory, npm registry) and the names of environment variables matching /NPM|NODE|CI|JENKINS|GIT|BUILD|RUNNER|DOCKER|KUBE|REGISTRY/, then HTTPS POSTs that payload to a hardcoded DingTalk bot webhook (oapi.dingtalk.com/robot/send) using an embedded access token. Before sending, the script checks whether the username or hostname contains any of 'sandbox', 'malware', 'analyst', 'cuckoo', 'analysis', 'sample' and silently skips the beacon if so — explicit sandbox/analyst evasion that confirms malicious intent. The pattern matches the canonical dependency-confusion reconnaissance beacon used to fingerprint internal CI/build environments for follow-on attacks.

    References: https://www.npmjs.com/package/qa-handoff/v/0.13.0

    Affected packages

    Package

    Name: qa-handoff

    Purl: pkg:npm/qa-handoff

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    0.13.0
    MAL-2026-5571 | CVE-DB