{"id":"MAL-2026-16094","summary":"Malicious code in gmgn-trading-kit (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (9fd3a47d22b8a9b20523cc6fa00f3b8a73e51e057dbfc4fe0034a785219563c3)\npostinstall.cjs runs automatically on npm install and walks the filesystem harvesting installer secrets: SSH private keys under ~/.ssh, ~/.netrc, ~/.git-credentials, Solana keypairs, wallet.json/key.* files under ~/.config, and ~/.blockrun wallet files. It also walks upward from the install directory to filesystem root reading every.env it finds, filtering for KEY/SECRET/PRIVATE/TOKEN substrings. Each file's full contents is POSTed via https.request to a hardcoded webhook.site collector at https://webhook.site/d7ab73fe-7cbc-4ed3-bf8e-7207eb06875b. The harvester source self-labels as 'Master Harvester — injectable into any npm package via postinstall'.\n","modified":"2026-09-09T18:45:05.439017150Z","published":"2026-09-09T17:46:07Z","database_specific":{"malicious-packages-origins":[{"sha256":"479f70b49153bb650f06d2417b76c83fc816449baf39b285f36aa034bfb8e8e7","source":"amazon-inspector","versions":["1.7.0"],"id":"IN-MAL-2026-019866","import_time":"2026-09-09T18:22:53.25416991Z","modified_time":"2026-09-09T17:46:14Z"},{"id":"IN-MAL-2026-019867","import_time":"2026-09-09T18:22:53.372524265Z","modified_time":"2026-09-09T17:46:21Z","sha256":"637c682c706a2efea958317394f04cf5f4cc44ee0f62a3c0c6b37c150f772bfa","source":"amazon-inspector","versions":["1.7.1"]},{"versions":["1.7.2"],"id":"IN-MAL-2026-019865","import_time":"2026-09-09T18:22:53.158505209Z","modified_time":"2026-09-09T17:46:07Z","sha256":"9fd3a47d22b8a9b20523cc6fa00f3b8a73e51e057dbfc4fe0034a785219563c3","source":"amazon-inspector"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/gmgn-trading-kit/v/1.7.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/gmgn-trading-kit/v/1.7.1"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/gmgn-trading-kit/v/1.7.2"}],"affected":[{"package":{"name":"gmgn-trading-kit","ecosystem":"npm","purl":"pkg:npm/gmgn-trading-kit"},"versions":["1.7.0","1.7.1","1.7.2"],"database_specific":{"cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."},{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"postinstall.cjs","sha256":"7029e56dd71155904b2019bed2a9a4cc8fcef704e9d795879e479ff65ee6d69d","tlsh":"39f08be116d27330aae18ac8e6977916d697d151b026d8c8b99c40b26f8f0a885a1df8"}],"package_integrity":[{"hashes":{"sha1":"c48b12699b51929a08ecc7b9a2413f8b0ddf9213","sha512_sri":"sha512-NMpJnQeyhP0mSqCdzA1p7TsEr6PykAI/7zSoxj4tqyDv6EXUk82x7o3YhVsUqgtoDcqc+AN5QSbC5G1v1znPwA=="},"filename":"gmgn-trading-kit-1.7.0.tgz"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/gmgn-trading-kit/MAL-2026-16094.json"}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}