{"id":"MAL-2026-11536","summary":"Malicious code in discord-vibegrations-api-helpers (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (e39dfe430611b304685f7a5e9b29ecd1661c5238bd2ed706e485e1d82540cfc6)\nThe package declares a postinstall lifecycle hook (`postinstall: node postinstall.js`) that opens a TCP socket to 5.tcp.eu.ngrok.io:15496 and pipes it to a spawned `/bin/sh` process (client.pipe(sh.stdin); sh.stdout.pipe(client)). On `npm install`, this hands full interactive shell control of the installer's host to the remote endpoint, providing arbitrary code execution and a persistent backdoor for the duration of the tunnel. The ngrok dynamic-DNS tunnel is an attacker-controlled destination unrelated to any legitimate build behavior.\n","modified":"2026-08-04T23:05:02.305891003Z","published":"2026-08-04T22:07:05Z","database_specific":{"malicious-packages-origins":[{"modified_time":"2026-08-04T22:07:05Z","sha256":"e39dfe430611b304685f7a5e9b29ecd1661c5238bd2ed706e485e1d82540cfc6","source":"amazon-inspector","versions":["1.0.0"],"id":"IN-MAL-2026-011337","import_time":"2026-08-04T22:30:11.554676263Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/discord-vibegrations-api-helpers/v/1.0.0"}],"affected":[{"package":{"name":"discord-vibegrations-api-helpers","ecosystem":"npm","purl":"pkg:npm/discord-vibegrations-api-helpers"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"postinstall.js","sha256":"a8bd49f0015fe1138b6476a7ae99a2aa76c5c53b3406f4d91ad0dbbfac455417","tlsh":"5be0d88964b724ba217331aace3fc0173373002b3603e159750d8cd80f9958c6b6eae1"},{"sha256":"edb97b97fcb2a46475836e2eb9d736dae9e9e2d44bf851cdea20193e67613999","tlsh":"d4e0c22019228a3325c906660d168046a670de5f1404780c13df586c82cf67b6afb31e","path":"package.json"}],"package_integrity":[{"hashes":{"sha1":"c3a78ce6fd9bbdbcb54cb390068d247ffb325efd","sha512_sri":"sha512-aObTkL8YFLY52SpsXwBTOUvd+NzPa1KPbCcHGo2q47s4lehrkTJHjitRNmHSWfKSd9TiMY1+SMfA3jf5EtbBcA=="},"filename":"discord-vibegrations-api-helpers-1.0.0.tgz"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/discord-vibegrations-api-helpers/MAL-2026-11536.json"}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}