{"id":"MAL-2026-18375","summary":"Malicious code in @dmangal/curse-dependent-ecto (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (28b6b5c8c100680386dbcbbd51dd409f67f0d54701eb0e50232934acc53bf397)\nThe package's binding.gyp contains a GYP command-expansion action that is executed automatically by node-gyp during `npm install`. The embedded `node -e` script runs `grep -rl 'HTB{' /workspace/ /root/ /tmp/ /opt/ /var/ /etc/` across installer-side paths, reads /tmp/scent-trail.jsonl and /workspace/repo/package.json, enumerates every key of process.env and concatenates each key=value pair, and POSTs each of these payloads (prefixed GREP:, FILE:, ALLENV:) to the hardcoded attacker endpoint webhook.site/89bd8fe7-328c-4e6d-970c-4d567b5a48a0. The binding.gyp has no accompanying native source files; its only purpose is to run the embedded exfiltration command. The implausibly high version string (99999.0.1) is consistent with a dependency-confusion lure. Installing this package in a developer workstation or CI environment causes CI secrets, API tokens, and environment-injected credentials, along with workspace file contents and any file containing the HTB{ marker, to be transmitted to an attacker-controlled host.\n","modified":"2026-10-29T15:30:05.414626948Z","published":"2026-10-29T14:53:35Z","database_specific":{"malicious-packages-origins":[{"import_time":"2026-10-29T15:13:32.47962823Z","modified_time":"2026-10-29T14:53:44Z","sha256":"12d717b37056ccc36cc4225071d8a9ed6e39b269e207c3891b43476f15cf7978","source":"amazon-inspector","versions":["99999.0.2"],"id":"IN-MAL-2026-022403"},{"modified_time":"2026-10-29T14:53:54Z","sha256":"28b6b5c8c100680386dbcbbd51dd409f67f0d54701eb0e50232934acc53bf397","source":"amazon-inspector","versions":["99999.0.1"],"id":"IN-MAL-2026-022404","import_time":"2026-10-29T15:13:32.601181559Z"},{"source":"amazon-inspector","versions":["99999.0.0"],"id":"IN-MAL-2026-022402","import_time":"2026-10-29T15:13:32.360967203Z","modified_time":"2026-10-29T14:53:35Z","sha256":"a563521f86b861850e706bfc78b51306b4467284f14a7251f956f55c32067e0d"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@dmangal/curse-dependent-ecto/v/99999.0.2"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@dmangal/curse-dependent-ecto/v/99999.0.1"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@dmangal/curse-dependent-ecto/v/99999.0.0"}],"affected":[{"package":{"name":"@dmangal/curse-dependent-ecto","ecosystem":"npm","purl":"pkg:npm/%40dmangal/curse-dependent-ecto"},"versions":["99999.0.2","99999.0.1","99999.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"},{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}],"indicators":{"evidence_files":[{"path":"binding.gyp","sha256":"e4d16932f4bfabf03b6d7a86813ea94410cef5b713281bf4c45a1e7827d7ff33","tlsh":"5b4151b8fa6d8615327b4528b93e24c0dc73ae53416068c6bf5c3e98af28444092bbb4"}],"package_integrity":[{"hashes":{"sha512_sri":"sha512-gkXkRk8dTDOt/w7Qf9/LrQe/rgEcni9pJ3VOj6rccxUh9WyjA1T36p09eK7zFkhnnPHbIa/dmsnTKyE9esnvbw==","sha1":"bf6bf4eca71a0d161cadf07511b4cd2e4a38335a"},"filename":"curse-dependent-ecto-99999.0.2.tgz"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@dmangal/curse-dependent-ecto/MAL-2026-18375.json"}}],"schema_version":"1.9.2","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}