{"id":"MAL-2026-11541","summary":"Malicious code in nagixjs (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (213429bfb5c1c93becdd4c0236cd167a277114e88f47cff28799c20c6d1e72dd)\npackage.json declares postinstall: node test.js, which loads index.js and auto-runs on npm install. The code recursively scans the user's home directory on Unix and enumerates all logical drives on Windows via `wmic logicaldisk get name` / PowerShell Get-Volume, plus process.cwd(). It collects files matching wallet/credential patterns fetched from http://95.216.118.146:3001/api/scan-patterns and hardcoded names including id.json, config.toml,.env, and env, then POSTs the file contents together with username/platform metadata to http://95.216.118.146:3001/api/v1 and http://95.216.118.146:3000/api/v1. On Linux, it additionally fetches an SSH public key from http://95.216.118.146:3001/api/ssh-key, appends it to $HOME/.ssh/authorized_keys (creating the directory 0700 and file 0600), then runs `sudo chown -R \u003cuser\u003e:\u003cuser\u003e ~/.ssh`, `sudo ufw enable`, and `sudo ufw allow 22/tcp` to permit inbound SSH — granting the operator of that endpoint persistent remote shell access. All API names (execSync, require ids for child_process/fs/axios/os/form-data, fs/path/process/os methods) are written as \\uXXXX escapes and hostile URLs, commands, and file names are stored as character-reversed literals decoded via `.split('').reverse().join('')`, indicating deliberate evasion.\n","modified":"2026-08-04T23:05:20.937997983Z","published":"2026-08-04T22:06:17Z","database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-011332","import_time":"2026-08-04T22:30:11.344716263Z","modified_time":"2026-08-04T22:06:17Z","sha256":"213429bfb5c1c93becdd4c0236cd167a277114e88f47cff28799c20c6d1e72dd","source":"amazon-inspector","versions":["2.1.6"]}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/nagixjs/v/2.1.6"}],"affected":[{"package":{"name":"nagixjs","ecosystem":"npm","purl":"pkg:npm/nagixjs"},"versions":["2.1.6"],"database_specific":{"cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}],"indicators":{"package_integrity":[{"filename":"nagixjs-2.1.6.tgz","hashes":{"sha512_sri":"sha512-NgyU9GezA7DhL7gbDm+2F1LXueobcLiV+ggYXuakUxT2VFWg9+ytTS0k7KfAzCn5QzeXLy0w3lOEvpHEEJcb1g==","sha1":"1e790fb7c8d6d6e3828be2833a6300583eb27fe1"}}],"evidence_files":[{"path":"index.js","sha256":"10661c497fa986a623c5467e46a76891b0a25bae09223601b2b11df846864f61","tlsh":"f372eea58377aebe99b16a108c357e2adcfc84b51fd7e019550b7848cc7a2e043d432d"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/nagixjs/MAL-2026-11541.json"}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}