MAL-2026-5785

    Dashboard / Malicious Package / MAL-2026-5785

    MAL-2026-5785

    Published: 15 Jun 2026Last Modified: 1 Sept 2026Aliases: 
    GHSA-wx43-hfx3-xw46

    Summary: Malicious code in ve-hemi-rewards (npm)

    Details: Source: amazon-inspector (a8252216c6621e6391775d34f5e32815ab8c2a830df080fed52113b4cf855aa1) On `npm install`, the package's preinstall lifecycle invokes postinstall.js, which collects hostname, username, and current working directory, then iterates process.env and filters keys against the regex /key|secret|token|pass|private|ssh|deploy|auth|api|rpc|wallet|sentry|docker|graph|slack|host/i. The matching key/value pairs (CI tokens, cloud credentials, SSH/deploy keys, RPC and wallet secrets, etc.) are JSON-serialized and POSTed over HTTPS to a hardcoded bare IP, 185.130.46.35:8443/collect. The package name 've-hemi-rewards' at version 999.0.0 with description 'Internal package' is a classic dependency-confusion shape — a high-version stub published to the public registry to override resolution of an organization's private package of the same name. There is no legitimate functionality; the package exists to harvest installer secrets.

    References: https://www.npmjs.com/package/ve-hemi-rewards/v/999.0.0, https://github.com/advisories/GHSA-wx43-hfx3-xw46

    Affected packages

    Package

    Name: ve-hemi-rewards

    Purl: pkg:npm/ve-hemi-rewards

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    999.0.0