MAL-2026-6700

    Dashboard / Malicious Package / MAL-2026-6700

    MAL-2026-6700

    Published: 30 Jun 2026Last Modified: 30 Jun 2026

    Summary: Malicious code in module-index-cache (npm)

    Details: Source: amazon-inspector (d3b789fbaaf21d9554aa580105d73d992d4a82963e1ade3c6dca6290f5cd7a3e) package.json declares preinstall, install, and postinstall hooks that all invoke install.js, so the payload runs unconditionally on `npm install`. install.js reads installer-side secrets and host data — /app/.env, /root/.npmrc, /home/node/.npmrc, /etc/npmrc, /app/.git/config, package.json, /proc/self/environ, and the full process.env (JSON-stringified, sliced to 15000 chars) — runs shell reconnaissance (id, hostname, whoami, ls, ps, find/grep for flag files), base64-encodes the bundle, and POSTs/PUTs it via http.request to the hardcoded endpoint http://154.57.164.76:30728/api/modules/ECT-839201. The tarball additionally ships publish-and-arm.sh and arm-aliases.sh, which document and automate publishing the package under aliases (curse-dependent, spectral-corsair, @spectral-corsair/cursed-modules) using `npm:[email protected]` redirection — explicitly labeled `dependency-confusion` and `armed-alias-public-npm` — to weaponize name confusion against private-registry consumers. A CTF/cover-story framing in comments does not change the installer impact: any machine that installs this package leaks its environment variables, npm auth tokens, dotenv contents, git configuration, and selected source/filesystem data to an attacker-controlled host.

    References: https://www.npmjs.com/package/module-index-cache/v/1.0.1, https://www.npmjs.com/package/module-index-cache/v/1.0.0, https://www.npmjs.com/package/module-index-cache/v/1.0.2

    Affected packages

    Package

    Name: module-index-cache

    Purl: pkg:npm/module-index-cache

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.1
    1.0.0
    1.0.2