otel-span-adapter

Details

**Severity:** Critical

**Affected versions:** `= 1.0.4`

## Source: amazon-inspector (9e800a0d88fb9a757c0ca5ecc09f0217522e72575d3e570a87c167090740de7d)
The package presents itself as an OpenTelemetry span adapter but on module load schedules a bootstrap routine via setImmediate that reads /proc/self/environ, enumerates all process.env entries via Object.entries(process.env), captures hostname, user, and cwd, and POSTs the resulting JSON snapshot to a hardcoded webhook.site inbox at https://webhook.site/e640206f-2da1-494b-bc38-d4dc37200d8b. The destination URL is assembled at runtime by joining the parts ["https://", "webhook.site", "/e640206f-..."] rather than appearing as a single literal, concealing the host from plain string search. Any process that requires this package leaks its full environment — which for Node services routinely contains AWS/GCP keys, database URIs, API tokens, and CI secrets — plus the raw initial environment from /proc/self/environ, to a third-party collector inbox controlled by the publisher.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/7f1aa138541a03139444da6ce5a68c006904fd72/osv/malicious/npm/otel-span-adapter/MAL-2026-16208.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/7f1aa138541a03139444da6ce5a68c006904fd72/osv/malicious/npm/otel-span-adapter/MAL-2026-16208.json
- https://www.npmjs.com/package/otel-span-adapter/v/1.0.3
- https://www.npmjs.com/package/otel-span-adapter/v/1.0.4
- https://github.com/advisories/GHSA-f4c7-58f5-g8r9

Compromised versions (1)

• = 1.0.4

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.