@prime0/pcomatch

GHSA-736x-m99h-5pfg

Malicious code in @prime0/pcomatch (npm)

Details

**Severity:** Critical

**Affected versions:** `= 1.0.0`

## Source: amazon-inspector (08299e41eb4feb9e324854bf5cd3386e6e52696b4b11443254374897a1ad3816)
index.js and the postinstall lifecycle script contact a hardcoded bare-IP endpoint at http://69.48.229.140:8080 over plain HTTP. On `npm install`, the postinstall hook collects host identifiers (hostname, username, platform, arch, cwd, node version, pid, all non-internal IP addresses, uptime, package name) and POSTs them as JSON to /b. On `require()` of the package main, the module beacons the same host, then polls /c every 30 seconds for JSON commands and executes the `c` field via child_process.exec, POSTing stdout/stderr back to /r. A source comment self-identifies the module as a stealth typosquat agent, while package.json advertises only a generic "small utility" description.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/a03f98a1b88f3ad29d120e41e5d5e14f25d25979/osv/malicious/npm/@prime0/pcomatch/MAL-2026-16206.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/a03f98a1b88f3ad29d120e41e5d5e14f25d25979/osv/malicious/npm/@prime0/pcomatch/MAL-2026-16206.json
- https://www.npmjs.com/package/@prime0/pcomatch/v/1.0.0
- https://github.com/advisories/GHSA-736x-m99h-5pfg

Compromised versions (1)

= 1.0.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.