MAL-2026-6099

    Dashboard / Malicious Package / MAL-2026-6099

    MAL-2026-6099

    Published: 18 Jun 2026Last Modified: 18 Jun 2026

    Summary: Malicious code in stream-read-35cf (npm)

    Details: Source: amazon-inspector (0597f71a1c39a743a4323636794601b480a1cda0c64df20d6bafa7ed601da84e) Package declares a postinstall hook ("postinstall": "node run.js") that auto-executes run.js on `npm install`. run.js imports os, fs, http, https, and child_process and collects host identifiers (os.hostname(), os.userInfo(), os.platform(), process.env.USER, process.cwd()), reads files via fs.readFileSync / fs.existsSync, base64-encodes data via Buffer.from(...).toString('base64'), and POSTs the results to remote endpoints over http/https (multiple POST call sites at lines 135, 138, 347, 354). The package name is a short random-suffixed identifier with no documented purpose, and the only effect of installing the package is the reconnaissance + exfiltration payload. This is the canonical install-time stealer shape.

    References: https://www.npmjs.com/package/stream-read-35cf/v/1.0.0

    Affected packages

    Package

    Name: stream-read-35cf

    Purl: pkg:npm/stream-read-35cf

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.0
    MAL-2026-6099 | CVE-DB