concierge-sdk

GHSA-7gx4-hj9w-hx25

Malicious code in concierge-sdk (npm)

Details

**Severity:** Critical

**Affected versions:** `= 99.99.101`

## Source: amazon-inspector (4de458111994244a0a590117185f9e345ff27043c129d4ea24fcb3be5f98f67b)
The package's declared postinstall script executes exfil_v2.js at `npm install` time. That script harvests the full process environment, current working directory, and config/secret files (.env, secrets.json, /etc/environment, /etc/profile, workflow files, git-history secret matches), curls the Azure Instance Metadata Service at 169.254.169.254 to obtain a managed-identity access token for vault.azure.net and lists Key Vault secrets with it, and uses the runner's GITHUB_TOKEN against api.github.com to read repository secrets and Actions artifacts. All collected data is POSTed to a hardcoded webhook.site endpoint. A sibling exfil.js duplicates full process.env exfiltration to the same webhook.site collector under User-Agent `continental-sdk/1.0`.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/c84d6ff0e4a864f0926f41430c4478a4c99e4108/osv/malicious/npm/concierge-sdk/MAL-2026-16145.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/c84d6ff0e4a864f0926f41430c4478a4c99e4108/osv/malicious/npm/concierge-sdk/MAL-2026-16145.json
- https://www.npmjs.com/package/concierge-sdk/v/99.99.100
- https://www.npmjs.com/package/concierge-sdk/v/99.99.101
- https://www.npmjs.com/package/concierge-sdk/v/99.99.99
- https://github.com/advisories/GHSA-7gx4-hj9w-hx25

Compromised versions (1)

= 99.99.101

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.