{"id":"MAL-2026-19227","summary":"Malicious code in r17d-sec-research-marker (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (0dbf3def098b1620e001e0831b405dd03ec20787a88a28892163cdfbe2eadbee)\nOn `npm install`, the package's postinstall script (collect.js) runs shell listings of the home directory and current working directory, probes for the presence of installer credential/config files (~/.npmrc, ~/.gitconfig, ~/.config/gh, ~/.novus), enumerates all process.env variable names, and POSTs the collected JSON to a hardcoded anonymous inspection endpoint at webhook.site/f18b2445-73d1-478a-9d3f-1cb21a407c61. The host reconnaissance includes the output of `whoami`, OS/kernel info, home-directory listing, dotfile presence inventory, and the full environment variable name list — a dataset that reveals CI provider, cloud credential presence, and secret-store usage, suitable for follow-on credential targeting. The script's self-label as a 'security research POC collecting metadata only' does not change the behavior: the installer did not opt in, the destination is an anonymous third-party collector, and the presence inventory of credential paths is itself exfiltration.\n","modified":"2026-11-13T04:30:07.239678213Z","published":"2026-11-13T03:58:29Z","database_specific":{"malicious-packages-origins":[{"source":"amazon-inspector","versions":["1.0.0"],"id":"IN-MAL-2026-022770","import_time":"2026-11-13T04:13:31.688114535Z","modified_time":"2026-11-13T03:58:29Z","sha256":"0dbf3def098b1620e001e0831b405dd03ec20787a88a28892163cdfbe2eadbee"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/r17d-sec-research-marker/v/1.0.0"}],"affected":[{"package":{"name":"r17d-sec-research-marker","ecosystem":"npm","purl":"pkg:npm/r17d-sec-research-marker"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"sha256":"e0dd62bcb4a39699880ce60c29c3d67a3a9a3a798059b9538571bfa349f11d9c","tlsh":"392144e3376d373c9ce1d29bf992a66299a7f380f10070f4c18456652f909ac4523df6","path":"collect.js"}],"package_integrity":[{"filename":"r17d-sec-research-marker-1.0.0.tgz","hashes":{"sha1":"185b66e66804172fb9576a7a9ad14fa9f364b452","sha512_sri":"sha512-UMOma+/YMsLXDYgWOzdg87cjE7wtRrAj2WlMQHlPX71wjPJyHbsycqlml32O/YUvBESuTFIfRAO49Kgti5l5Gg=="}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/r17d-sec-research-marker/MAL-2026-19227.json"}}],"schema_version":"1.9.2","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}