MAL-2026-6241

    Dashboard / Malicious Package / MAL-2026-6241

    MAL-2026-6241

    Published: 20 Jun 2026Last Modified: 20 Jun 2026

    Summary: Malicious code in atlasora-shared (npm)

    Details: Source: amazon-inspector (e1bd49976f774ef8357d29c74bc366b851e69a611cc5894f1a59621d91f9daba) package.json declares `"postinstall": "node install.js"`, causing install.js to run automatically on `npm install`. install.js requires `https`, `fs`, `os`, and `child_process`, collects host identifiers via `os.hostname()` and `os.userInfo()`, executes shell commands via `execSync(...)`, probes filesystem paths with `fs.existsSync(...)`, and POSTs the collected data to a remote endpoint via `https.request(...)`. This is the canonical install-time system-information exfiltration pattern: identifying data is gathered from the installer's machine and beaconed outbound on every install, with no documented purpose tied to the package's stated function. Installing this package automatically leaks host and user information to an external destination.

    References: https://www.npmjs.com/package/atlasora-shared/v/1.0.0

    Affected packages

    Package

    Name: atlasora-shared

    Purl: pkg:npm/atlasora-shared

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.0
    MAL-2026-6241 | CVE-DB