MAL-2026-5778

    Dashboard / Malicious Package / MAL-2026-5778

    MAL-2026-5778

    Published: 15 Jun 2026Last Modified: 1 Sept 2026Aliases: 
    GHSA-hjwc-fchg-m65q

    Summary: Malicious code in hemi-earn-actions (npm)

    Details: Source: amazon-inspector (a9c2a72c75e835bc78738de0839bd4727df93d6bcb8aed2215289973996c4f3c) On `npm install`, the package's preinstall script (postinstall.js) collects host metadata (hostname, username, cwd, npm config) and iterates process.env, filtering keys against the regex /key|secret|token|pass|private|ssh|deploy|auth|api|rpc|wallet|sentry|docker|graph|slack|host/i to harvest credential-shaped variables. The resulting JSON payload is POSTed over HTTPS to a hardcoded bare-IP endpoint, https://185.130.46.35:8443/collect. The package itself has no functional API — index.js is `module.exports = {}` — and the version `999.0.0` plus the description 'Internal package' fit the dependency-confusion pattern aimed at organizations that resolve a private name `hemi-earn-actions` from the public registry. Installer harm is automatic credential exfiltration of CI/developer secrets to attacker-controlled infrastructure.

    References: https://www.npmjs.com/package/hemi-earn-actions/v/999.0.0, https://github.com/advisories/GHSA-hjwc-fchg-m65q

    Affected packages

    Package

    Name: hemi-earn-actions

    Purl: pkg:npm/hemi-earn-actions

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    999.0.0
    MAL-2026-5778 | CVE-DB