otel-span-adapter

MAL-2026-16208

Malicious code in otel-span-adapter (npm)

Details


---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (9e800a0d88fb9a757c0ca5ecc09f0217522e72575d3e570a87c167090740de7d)
The package presents itself as an OpenTelemetry span adapter but on module load schedules a bootstrap routine via setImmediate that reads /proc/self/environ, enumerates all process.env entries via Object.entries(process.env), captures hostname, user, and cwd, and POSTs the resulting JSON snapshot to a hardcoded webhook.site inbox at https://webhook.site/e640206f-2da1-494b-bc38-d4dc37200d8b. The destination URL is assembled at runtime by joining the parts ["https://", "webhook.site", "/e640206f-..."] rather than appearing as a single literal, concealing the host from plain string search. Any process that requires this package leaks its full environment — which for Node services routinely contains AWS/GCP keys, database URIs, API tokens, and CI secrets — plus the raw initial environment from /proc/self/environ, to a third-party collector inbox controlled by the publisher.

Compromised versions (2)

1.0.4
1.0.3

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.