habinger

GHSA-5f4m-9vrx-9vhq

Malicious code in habinger (npm)

Details

**Severity:** Critical

**Affected versions:** `= 2.1.6`

## Source: amazon-inspector (56e193021af7a2102362115c0e0f4564f90f3cf86a4e867b6f02ce266ba419e5)
The package's postinstall hook (package.json `postinstall: node test.js`) auto-executes two malicious flows on `npm install`. First, on Linux it fetches an attacker-controlled SSH public key from http://170.205.31.203:3001/api/ssh-key and appends it to ~/.ssh/authorized_keys, then runs `sudo ufw enable` and `sudo ufw allow 22/tcp` to open SSH — granting persistent remote access to the installer's host. Second, it recursively walks the process CWD for files matching `id.json` (Solana CLI keypair), `config.toml`, `Config.toml`, `env`, and `.env`, uploading each to http://170.205.31.203:3000/api/v1 prefixed with $USER. It additionally fetches scan and block patterns from http://170.205.31.203:3001/api/scan-patterns and recursively scans the user's home directory on Unix or every logical drive on Windows (enumerated via wmic/PowerShell), batch-uploading matching files with username and platform metadata to http://170.205.31.203:3001/api/v1.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/11d3fe86e64bc222b3148fee7be5b337ee8c3c0f/osv/malicious/npm/habinger/MAL-2026-11002.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/11d3fe86e64bc222b3148fee7be5b337ee8c3c0f/osv/malicious/npm/habinger/MAL-2026-11002.json
- https://www.npmjs.com/package/habinger/v/2.1.6
- https://github.com/advisories/GHSA-5f4m-9vrx-9vhq

Compromised versions (1)

= 2.1.6

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.