{"id":"MAL-2026-16304","summary":"Malicious code in @nimbusedge2/authxsas1 (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (0b27280b8f4c1e044e49b77e58c7c8de895a002f51be51756bc40e909d3f6fa1)\npackage.json declares a preinstall lifecycle script that runs automatically on `npm install`. The script uses curl to fetch the cloud instance metadata service (169.254.169.254, accessed via the nip.io wildcard-DNS wrapper `169.254.169.254.nip.io/latest/meta-data/`), base64-encodes the response, and POSTs it to a hardcoded third-party endpoint at http://canarytokens.com/terms/7dc94zmd3so67n5vbz5bxmt7v/contact.php. On cloud and CI installers this discloses instance identity metadata and, where IMDSv1 is reachable, temporary IAM credentials to the destination. The package's description field self-labels the beacon as an 'Authorized report' with a wearehackerone.com contact address; that label is author-controlled and does not change the behavior class — installing the package causes installer-side host and cloud metadata to be sent off-host to a canarytoken beacon.\n","modified":"2026-09-21T03:30:17.635425858Z","published":"2026-09-21T03:06:48Z","database_specific":{"malicious-packages-origins":[{"source":"amazon-inspector","versions":["1.1.0"],"id":"IN-MAL-2026-020200","import_time":"2026-09-21T03:24:20.793924532Z","modified_time":"2026-09-21T03:06:48Z","sha256":"0b27280b8f4c1e044e49b77e58c7c8de895a002f51be51756bc40e909d3f6fa1"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@nimbusedge2/authxsas1/v/1.1.0"}],"affected":[{"package":{"name":"@nimbusedge2/authxsas1","ecosystem":"npm","purl":"pkg:npm/%40nimbusedge2/authxsas1"},"versions":["1.1.0"],"database_specific":{"cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}],"indicators":{"package_integrity":[{"filename":"authxsas1-1.1.0.tgz","hashes":{"sha512_sri":"sha512-dmnPZZhfLMwp5jbBiybJNxeZN/gOVLz3GwCHY2ZiXxG3BeRNPliTjG3kCBHhQ0CTImNGNNV29L0BrrS23K03ow==","sha1":"1abe81349ad7271f4bb2e14cff4680c388214d29"}}],"evidence_files":[{"path":"package.json","sha256":"9deec62ca431734fd37ac8c8dc0d80ae644122f888c1774e3ec2261571d752a6","tlsh":"dce0c02816107c772dcdc7e0b676432976b47b1f4e80ae0c9093091c1e2d9de3a23f44"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@nimbusedge2/authxsas1/MAL-2026-16304.json"}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}