crosswalker

GHSA-9wxp-r2hc-p64q

Malicious code in crosswalker (npm)

Details

**Severity:** Critical

**Affected versions:** `= 1.0.1`

## Source: amazon-inspector (b352c9c53fc71d511dae5d0fd8acc4462286092822d70e37dd413593f12bf0d3)
package.json declares `preinstall: node index.js`, causing index.js to run automatically on `npm install`. The script collects hostname, platform, arch, homedir, username, uid/gid, shell, OS info, cwd, and the output of `whoami` and `id`, then POSTs the JSON payload to a hardcoded URL at `https://kbz9yyzq2mtljdwwf6r0tpzlfcl39txi.oastify.com/detox56`. The destination is a Burp Collaborator subdomain — out-of-band infrastructure used to confirm exfiltration / RCE during dependency-confusion reconnaissance. Installer host and user identifiers leave the machine without consent on every install.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/69ce1ab0d67ec6170adf5c3f9fba790ede81f48f/osv/malicious/npm/crosswalker/MAL-2024-2031.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/69ce1ab0d67ec6170adf5c3f9fba790ede81f48f/osv/malicious/npm/crosswalker/MAL-2024-2031.json
- https://www.npmjs.com/package/crosswalker/v/18.2.1
- https://github.com/advisories/GHSA-9wxp-r2hc-p64q

Compromised versions (1)

= 1.0.1

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.