{"id":"MAL-2026-10944","summary":"Malicious code in zer0onetencent (npm)","details":"The zer0onetencent package was published to the npm registry by user 't2423048543' (maintainer email t2423048543@gmail.com). It is described as 'A simple date formatting utility' but ships no such functionality; index.js only exports a hello() stub returning the package name, indicating a package created to deliver an install-time payload.\n\nThe package.json declares a postinstall hook (\"node postinstall.js\") that runs automatically at npm install time. The bundled postinstall.js embeds a shell command chain that performs cloud-metadata SSRF and credential/environment harvesting: it queries a public IP echo service (http://cip.cc), probes a Meituan/Sankuai internal SSRF test endpoint (https://mtsrc-test.sankuai.com/ssrf), requests AWS EC2 instance metadata credentials for the IAM role 'sandyclaw-canary-worker-role' (http://169.254.169.254/latest/meta-data/iam/security-credentials/sandyclaw-canary-worker-role), and reads Tencent Cloud metadata (http://metadata.tencentyun.com/latest/meta-data/ and http://169.254.0.23/latest/meta-data/). It then reads the installing process's environment via /proc/self/environ and exfiltrates the concatenated output, together with a directory listing of /data/, by HTTP POST to the attacker-controlled Burp Collaborator endpoint http://t5z0g2hzoydgi8mz3pfkzg8dm4svgl4a.oastify.com (paths /metadata and /data).\n\nAs shipped, the malicious command chain is stored inside postinstall.js as a JSON document (a copy of a package manifest) rather than as executable JavaScript, so the 'node postinstall.js' hook raises a syntax error and the embedded payload does not execute as-published; the intent and payload are nonetheless unambiguously malicious. A sibling package (zer0onetencent2) by the same maintainer carries an identical payload differing only in the Collaborator subdomain.\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (db63abb2f3fa01d1de98c5b63e2b7cde88f35ddb18a752e670dc982fc0ddcc89)\nThe package is presented as 'A simple date formatting utility' with a trivial index.js exporting a hello() function, but its postinstall lifecycle script executes a shell one-liner that queries cloud instance metadata services — the AWS IMDS role credentials endpoint at 169.254.169.254 (path /latest/meta-data/iam/security-credentials/sandyclaw-canary-worker-role), the Tencent Cloud metadata service at metadata.tencentyun.com, and an additional internal SSRF endpoint — writes the responses to /tmp, reads /proc/self/environ, then POSTs the aggregated output to the hardcoded Burp Collaborator subdomain t5z0g2hzoydgi8mz3pfkzg8dm4svgl4a.oastify.com. Running on cloud build infrastructure yields short-lived IAM/STS credentials and installer environment variables to the operator of that collaborator host. The stated package purpose is a decoy for the install-time credential-harvest behavior.\n","modified":"2026-08-04T22:05:23.449715354Z","published":"2026-07-20T00:00:00Z","database_specific":{"malicious-packages-origins":[{"modified_time":"2026-08-04T21:17:57Z","sha256":"db63abb2f3fa01d1de98c5b63e2b7cde88f35ddb18a752e670dc982fc0ddcc89","source":"amazon-inspector","versions":["1.0.0"],"id":"IN-MAL-2026-011001","import_time":"2026-08-04T21:33:13.059427548Z"}]},"references":[{"type":"WEB","url":"https://www.npmjs.com/package/zer0onetencent"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/zer0onetencent/v/1.0.0"}],"affected":[{"package":{"name":"zer0onetencent","ecosystem":"npm","purl":"pkg:npm/zer0onetencent"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"versions":["1.0.0"],"database_specific":{"indicators":{"evidence_files":[{"tlsh":"d6014ed92261b9736dc29e79e376034bb400f8472ec05b95c1d518f0898d671b255b1e","path":"postinstall.js","sha256":"c629b2e94bb301b3fc4c43192e5f40a4c88fcfa8d05d4224495d4b4a3908b768"},{"sha256":"f64b7a56d6c48b30fa95cafb22515f570b3a3ebd1d45fd82089787338caa127f","tlsh":"2dd0a7144d105a336bd496a99da3490bbe219e1b024c7c1d23db255c83dfab3c4fe31e","path":"package.json"}],"package_integrity":[{"hashes":{"sha512_sri":"sha512-1d8UlS/qCcFq6F50GnXtXBb/Q9HKHhqX1LLCAC7ae+kW8S5747t9hmYm6mnggi/Smx28golLnVmasddu6JcKRA==","sha1":"9a42071550142f23fc3faf4b2993b796b382ec51"},"filename":"zer0onetencent-1.0.0.tgz"}]},"iocs":{"domains":["t5z0g2hzoydgi8mz3pfkzg8dm4svgl4a.oastify.com"],"urls":["http://t5z0g2hzoydgi8mz3pfkzg8dm4svgl4a.oastify.com/metadata","http://t5z0g2hzoydgi8mz3pfkzg8dm4svgl4a.oastify.com/data"]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/zer0onetencent/MAL-2026-10944.json","cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}]}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"SafeDep","contact":["https://safedep.io"],"type":"FINDER"}]}