{"id":"MAL-2026-12350","summary":"Malicious code in chart-data-utils (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (3980b39b1ba77c4c8df0b8e08016a299640a60b6255c1ea8be1883343ec750e9)\nchart-data-utils@1.0.0 advertises itself as a chart data/color helper library (index.js contains only trivial color utilities), but ships a postinstall.js that runs at npm install time and performs credential harvesting and host reconnaissance. The postinstall shells out via child_process.exec to: (1) collect hostname, whoami/id output, Docker/cgroup indicators, sudo -ln, ps aux, ip addr/route; (2) enumerate process environment variables and grep-filter for KEY|TOKEN|SECRET|CREDENTIAL|NPM_TOKEN|AWS_|AZURE|GCP|GITHUB_TOKEN plus GitHub Actions identity fields (GITHUB_TOKEN, GITHUB_REPOSITORY, GITHUB_ACTOR, RUN_ID); (3) probe cloud instance-metadata endpoints at 169.254.169.254 (AWS), 100.100.100.200 (Aliyun), metadata.google.internal (GCP), metadata.tencentyun.com (Tencent), and an internal host tst.woa.com; (4) base64-encode the collected data and POST/GET it over plain HTTP to the hardcoded Burp Collaborator subdomain pzs5w7ntzhsnepwk564lyfdci3oucl0a.oastify.com. The package name/description are a cover story for a CI credential harvester; Chinese-language comments (\"分片回传版\") in the postinstall reference tst.woa.com.\n","modified":"2026-08-05T13:35:03.523369019Z","published":"2026-08-05T12:31:46Z","database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-014692","import_time":"2026-08-05T13:08:37.963621839Z","modified_time":"2026-08-05T12:31:46Z","sha256":"3980b39b1ba77c4c8df0b8e08016a299640a60b6255c1ea8be1883343ec750e9","source":"amazon-inspector","versions":["1.0.0"]}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/chart-data-utils/v/1.0.0"}],"affected":[{"package":{"name":"chart-data-utils","ecosystem":"npm","purl":"pkg:npm/chart-data-utils"},"versions":["1.0.0"],"database_specific":{"cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}],"indicators":{"evidence_files":[{"sha256":"b0fd56908ccfeea473ff249ab63aa2d4eb43d34dc160c2f9da94836587a5cb84","tlsh":"cc71f2c4da6cb837333ad550e65a48075e87e8af4eb8ff8158362e20010cb463677a77","path":"postinstall.js"},{"tlsh":"13e07d30e91096332dc597a92d97c2013b315d0712083c4817972518439f2f1e0ffb1d","path":"package.json","sha256":"77a52dfc0e1a660cb457ebfbc70984acce594f37af10c0519c366c6d5f16ba15"}],"package_integrity":[{"filename":"chart-data-utils-1.0.0.tgz","hashes":{"sha512_sri":"sha512-crHgDGf2OG9zQ0IHRk362t23rdcRxrJnyJigiGSGjtmGwEuz5qqAsKPjY+1y6AJAIWQKKpyWTXdKK4zmG5O7dg==","sha1":"701a44eee22ef2e3819a1d6df5d544fbc45d2473"}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/chart-data-utils/MAL-2026-12350.json"}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}