{"id":"MAL-2026-10942","summary":"Malicious code in aftermath-sui (npm)","details":"The aftermath-sui package was published to the npm registry by user 'jet0010001' (maintainer email bremagml0002@gmail.com) as part of a dependency-confusion / reconnaissance campaign impersonating the Aftermath Finance SDK (Aftermath Finance is a DeFi protocol on the Sui blockchain). The package was published at version 99.0.0 - an inflated version number characteristic of dependency-confusion attacks, intended to cause a misconfigured resolver to prefer this public lookalike over the intended private/internal dependency of the same name.\n\nThe package declares a preinstall hook (\"node setup.js || true\") that executes automatically at npm install time, before any application code runs. The bundled setup.js performs host reconnaissance and credential harvesting: it collects the machine hostname, the current OS username, the current working directory, the contents of /etc/hostname, and the output of 'git remote -v', and it enumerates process environment variables whose names match the pattern /key|secret|token|pass|auth|private|drone|gitea|sui|admin|deploy/i - capturing API keys, secrets, tokens, passwords, and Sui/deploy/CI credentials. The collected data is serialized to JSON and exfiltrated via an HTTPS POST to the hardcoded attacker-controlled endpoint https://2.25.140.71:8443/aftermath/npm-dep-conf, with TLS certificate verification disabled (rejectUnauthorized: false) so a self-signed listener is accepted. Errors are silently swallowed so the install appears to succeed. The published module code (index.js) is a benign stub exporting only { version: \"99.0.0\" }, consistent with a package built solely to deliver the install-time beacon.\n\nThe install-time payload is byte-for-byte identical across the campaign's packages (aftermath-finance, aftermath-sui, aftermathfi), all published by the same maintainer within seconds of each other and all beaconing to the same collector.\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (0157a24eb15337a04879abcb94a3293e67dc6cea5efce56541aaa7a43ab5cd53)\nThe package's preinstall script (setup.js, invoked via scripts.preinstall = 'node setup.js') runs automatically on npm install. It enumerates process.env and filters keys matching /key|secret|token|pass|auth|private|drone|gitea|sui|admin|deploy/i, and additionally collects os.hostname(), os.userInfo().username, process.cwd(), the contents of /etc/hostname, and the output of `git remote -v`. The collected JSON is POSTed to a hardcoded bare-IP endpoint at https://2.25.140.71:8443/aftermath/npm-dep-conf with TLS certificate verification disabled (rejectUnauthorized:false). The destination is a raw IP unrelated to any legitimate Aftermath Finance / Sui infrastructure, and the package name resembles the Aftermath Finance ecosystem, consistent with a typosquat targeting Sui/Aftermath developers.\n","modified":"2026-07-28T14:37:18.962664589Z","published":"2026-07-20T00:00:00Z","database_specific":{"malicious-packages-origins":[{"import_time":"2026-07-28T14:20:00.223841276Z","id":"IN-MAL-2026-010941","modified_time":"2026-07-28T13:39:32Z","versions":["99.0.0"],"source":"amazon-inspector","sha256":"0157a24eb15337a04879abcb94a3293e67dc6cea5efce56541aaa7a43ab5cd53"}]},"references":[{"type":"WEB","url":"https://www.npmjs.com/package/aftermath-sui"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/aftermath-sui/v/99.0.0"}],"affected":[{"package":{"name":"aftermath-sui","ecosystem":"npm","purl":"pkg:npm/aftermath-sui"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"versions":["99.0.0"],"database_specific":{"indicators":{"evidence_files":[{"path":"setup.js","sha256":"729b7aaaa8b18cc377bc350faa056e25d043001ab7a86a65207b2fe676a0d808","tlsh":"6b1154e093f0f3719ea595a4f04b900b5153d0077d5b7c60f69881651f8d65ca5b2ce6"}],"package_integrity":[{"filename":"aftermath-sui-99.0.0.tgz","hashes":{"sha1":"a9e1bf317a92443f5210d1d82c5ac197fbff556c","sha512_sri":"sha512-P52SIckgbuG94kXBI7/kAH/hYwI4kxmhJ/UZ1DCm5aCNFWhpQzF/TvU7Eql4dAJMS00+7tLSYLYlYvNVw8d/lg=="}}]},"iocs":{"ips":["2.25.140.71"],"urls":["https://2.25.140.71:8443/aftermath/npm-dep-conf"]},"cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"},{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/aftermath-sui/MAL-2026-10942.json"}}],"schema_version":"1.7.5","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"SafeDep","contact":["https://safedep.io"],"type":"FINDER"}]}