commerce-materials

GHSA-79cv-pg4c-wmph

Malicious code in commerce-materials (npm)

Details

**Severity:** Critical

**Affected versions:** `= 1.0.0`

## Source: amazon-inspector (bdfff371a76fd4cef2247de8c595a3981d58353391141b58a8ce31e03ec9da6d)
[email protected] declares preinstall and postinstall lifecycle scripts that run callback.js on every npm install. callback.js collects hostname, username, platform, cwd, home directory, CI/cloud provider fingerprints, network interface addresses, and a filtered list of process.env variable names matching credential-shaped patterns (token, secret, key, password, aws, azure, gcp, npm, ssh, jwt). It also probes the current working directory for the presence of.env,.env.local,.env.production,.npmrc,.yarnrc, package-lock.json, yarn.lock,.git/config,.docker/config.json, credentials, and secrets.json. The assembled report is POSTed to api.telegram.org using a hardcoded bot token (8636277735) and chat_id (1064260758). A secondary DNS-based exfiltration channel base64-encodes host, user, and CI fields into a subdomain of dc-callback.example.com and issues dns.resolve queries, providing a fallback when HTTPS egress is filtered. The behavior fires automatically on npm install with no user interaction and no documented opt-in.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/af486be301974b4c4068b1c7baa77731f37fa05e/osv/malicious/npm/commerce-materials/MAL-2026-16330.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/af486be301974b4c4068b1c7baa77731f37fa05e/osv/malicious/npm/commerce-materials/MAL-2026-16330.json
- https://www.npmjs.com/package/commerce-materials/v/1.0.0
- https://github.com/advisories/GHSA-79cv-pg4c-wmph

Compromised versions (1)

= 1.0.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.