bulk-add-sdk

GHSA-j7qr-p7vp-jvhx

Malicious code in bulk-add-sdk (npm)

Details

**Severity:** Critical

**Affected versions:** `= 1.99.99`

## Source: amazon-inspector (b131d84c624f7eb89d720ed0ec1435eef5f5f9ff800d1cef88b20c18c7374023)
Package declares scripts.install: "node extract.js thd-orangepay", causing extract.js to run automatically on npm install. The script collects hostname, platform, arch, cwd, and the machine's public IP (obtained by shelling out via execSync to `curl -s ifconfig.me || wget...`) and transmits the data to a hardcoded subdomain of wallclip.me over two channels: an HTTPS POST via https.request with rejectUnauthorized: false (disabling certificate verification), and a DNS lookup against a beacon of the form `${project_id}.${safeHost}.[...].wallclip.me` so a passive DNS observer receives the hostname and project identifier even when outbound TCP/443 is blocked. The package main entry is a stub with no library functionality, so the install-time beacon is the package's sole effect. The package name resembles a legitimate SDK but ships only a reconnaissance beacon targeting a non-first-party domain.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/af486be301974b4c4068b1c7baa77731f37fa05e/osv/malicious/npm/bulk-add-sdk/MAL-2026-16325.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/af486be301974b4c4068b1c7baa77731f37fa05e/osv/malicious/npm/bulk-add-sdk/MAL-2026-16325.json
- https://www.npmjs.com/package/bulk-add-sdk/v/1.99.99
- https://github.com/advisories/GHSA-j7qr-p7vp-jvhx

Compromised versions (1)

= 1.99.99

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.