@ziedzzz/demo-canary

GHSA-j2pv-fh3g-jp56

Malicious code in @ziedzzz/demo-canary (npm)

Details

**Severity:** Critical

**Affected versions:** `= 1.0.0`

## Source: amazon-inspector (e6350184f3eabc17d37726cdd71ea97666cef28b2e1c125cffeb56e7c474b8dd)
On `npm install`, the package's declared postinstall script executes index.js, which collects a host fingerprint (hostname, username, home directory, cwd, platform/arch/OS release, CPU model, memory, network interfaces including MAC/OUI, process info) and enumerates process.env for variable names matching TOKEN|SECRET|KEY|PASS|AWS_|GCP_|AZURE_|SSH|GIT|NPM|DOCKER. The collected data is transmitted via HTTPS GET to the hardcoded third-party endpoint telegrambot-aebk.onrender.com/ping. The behavior fires automatically on install without opt-in and discloses the installer's host identity and credential-variable inventory to an author-controlled destination.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/1f0efa038b4952b6f39151f24f216b7f464d67c4/osv/malicious/npm/@ziedzzz/demo-canary/MAL-2026-17652.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/1f0efa038b4952b6f39151f24f216b7f464d67c4/osv/malicious/npm/@ziedzzz/demo-canary/MAL-2026-17652.json
- https://www.npmjs.com/package/@ziedzzz/demo-canary/v/1.0.0
- https://github.com/advisories/GHSA-j2pv-fh3g-jp56

Compromised versions (1)

= 1.0.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.