{"id":"MAL-2026-18377","summary":"Malicious code in spectral-core (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (451c36f03e81be0ff6c85334587d7ff401de1e5134e179557ec4bc454cd7ba76)\nThe tarball ships only package.json and binding.gyp (plus a markdown file), with gypfile: true set in package.json so npm invokes node-gyp rebuild on install. binding.gyp declares a 'none'-type target with no native source files; its sole purpose is an inline action that runs `node -e` with an embedded script. At install time that script reads /proc/1/environ and /proc/self/environ (container/pod entrypoint environment variables, which routinely contain CI/CD secrets and cloud credentials), collects DNS/socket/ARP/route reconnaissance output, queries the AWS EC2 instance metadata service at 169.254.169.254 for user-data and meta-data, and POSTs the collected data to the hardcoded collector https://webhook.site/d6092bdc-05c0-45da-a280-c343ea6d6156. The package exposes no library functionality — main: index.js is declared but index.js is not shipped — so the binding.gyp exists solely as a vehicle for install-time code execution and credential exfiltration. The name resembles the legitimate @stoplight/spectral-core project but the shipped contents are unrelated to it.\n","modified":"2026-10-29T15:30:06.850001529Z","published":"2026-10-29T14:57:43Z","database_specific":{"malicious-packages-origins":[{"modified_time":"2026-10-29T14:58:15Z","sha256":"451c36f03e81be0ff6c85334587d7ff401de1e5134e179557ec4bc454cd7ba76","source":"amazon-inspector","versions":["3.0.6"],"id":"IN-MAL-2026-022409","import_time":"2026-10-29T15:13:33.239756316Z"},{"modified_time":"2026-10-29T14:58:46Z","sha256":"54cb50bba7e6f19319df8f23816710ec57a29dc6d69025f3b9c5ddf71f01325c","source":"amazon-inspector","versions":["3.0.4"],"id":"IN-MAL-2026-022413","import_time":"2026-10-29T15:13:33.67013451Z"},{"source":"amazon-inspector","versions":["3.0.10"],"id":"IN-MAL-2026-022407","import_time":"2026-10-29T15:13:32.968949059Z","modified_time":"2026-10-29T14:58:00Z","sha256":"79c6086910623ed4eed9f7bb0f1305df0cacd70ab45112d52a295b47a9d9eb5a"},{"versions":["3.0.5"],"id":"IN-MAL-2026-022411","import_time":"2026-10-29T15:13:33.465182254Z","modified_time":"2026-10-29T14:58:31Z","sha256":"8b8de448b1a3fae15b672af020951d2cc5556f943bb2a302f4ccb23ffde8aaa1","source":"amazon-inspector"},{"sha256":"baeee5e622f864693e676d6fc1c780c842218a5b7a6d06bedce5d732ea40629a","source":"amazon-inspector","versions":["3.0.3"],"id":"IN-MAL-2026-022415","import_time":"2026-10-29T15:13:33.899623308Z","modified_time":"2026-10-29T14:59:12Z"},{"sha256":"cd35974c3234a6dad4309c3401da17d4fbf5fbf8465bd4f351be966f9500aa09","source":"amazon-inspector","versions":["3.0.11"],"id":"IN-MAL-2026-022406","import_time":"2026-10-29T15:13:32.87266895Z","modified_time":"2026-10-29T14:57:51Z"},{"source":"amazon-inspector","versions":["3.0.7"],"id":"IN-MAL-2026-022408","import_time":"2026-10-29T15:13:33.08671578Z","modified_time":"2026-10-29T14:58:07Z","sha256":"de6a163084b23d2a75e3512f9cbe77045ba53182d1e08752c00a0d886e2cd62f"},{"import_time":"2026-10-29T15:13:33.566689005Z","modified_time":"2026-10-29T14:58:39Z","sha256":"e06fe8f5e55d720c49a2919236fdc93fd33d62a937078c83060ee251bae4cbe4","source":"amazon-inspector","versions":["3.0.12"],"id":"IN-MAL-2026-022412"},{"import_time":"2026-10-29T15:13:32.733484061Z","modified_time":"2026-10-29T14:57:43Z","sha256":"fdc14a289befd2f77d2b9d8084d7a8f1db9a8de799407a2f12b338d4101d0272","source":"amazon-inspector","versions":["3.0.9"],"id":"IN-MAL-2026-022405"},{"source":"amazon-inspector","versions":["3.0.2"],"id":"IN-MAL-2026-022410","import_time":"2026-10-29T15:13:33.366659328Z","modified_time":"2026-10-29T14:58:25Z","sha256":"d87e383d290979921fc31446bf3aa12ceb70744065334b1ea0eeda11dd4c979f"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/spectral-core/v/3.0.6"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/spectral-core/v/3.0.4"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/spectral-core/v/3.0.10"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/spectral-core/v/3.0.5"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/spectral-core/v/3.0.3"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/spectral-core/v/3.0.11"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/spectral-core/v/3.0.7"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/spectral-core/v/3.0.12"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/spectral-core/v/3.0.9"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/spectral-core/v/3.0.2"}],"affected":[{"package":{"name":"spectral-core","ecosystem":"npm","purl":"pkg:npm/spectral-core"},"versions":["3.0.6","3.0.4","3.0.10","3.0.5","3.0.3","3.0.11","3.0.7","3.0.12","3.0.9","3.0.2"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/spectral-core/MAL-2026-18377.json","indicators":{"package_integrity":[{"filename":"spectral-core-3.0.6.tgz","hashes":{"sha1":"cc4e240b34a543c4945e216757e0ecc65198df1c","sha512_sri":"sha512-N+bFcMCDAZSFlzi2Xho05OzcUlrQpcM7hJXF+OpyCT0kuVCBdpUtxMz6nUMIJtJnfClvugdxaBfhUC2E2bO6Sw=="}}],"evidence_files":[{"sha256":"0f314f2559c6a7efcdb2e539d598afd3f3042b9652ce30bd58fddfd60bfa454c","tlsh":"d7314098b7748abb56d0461dd6ae8703c133a16286c07ec4b7ec6ded1f0e4411a34ef1","path":"binding.gyp"}]},"cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."},{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}]}}],"schema_version":"1.9.2","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}