{"id":"MAL-2026-4455","summary":"Malicious code in @thebros/create-benjamin (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (53fb816939bb505cdabc374418983428298b09a29e5789033943301642b8b156)\nThe package tarball ships a `.env` file containing a live-looking OpenAI API key (`OPENAI_API_KEY=sk-proj-...`). The CLI entry point `bin/index.js` calls `import \"dotenv/config\"` at line 3, which auto-loads that `.env` from the package directory at startup. At line 13 the key is read via `process.env.OPENAI_API_KEY`. Two installer-affecting consequences result: (1) the author's third-party API credential is redistributed to every installer of the package, who can extract it from the tarball and abuse it against OpenAI under the author's account; (2) when a user runs `create-benjamin` without setting their own `OPENAI_API_KEY`, their project-description prompt is silently sent to OpenAI billed against the author's account, with no disclosure that a hardcoded key is in use. The key should be revoked, removed from the published tarball, and the CLI should require the user to provide their own key.\n","modified":"2026-05-27T00:31:51.670349234Z","published":"2026-05-22T09:56:48Z","withdrawn":"2026-05-26T21:14:22Z","database_specific":{"malicious-packages-origins":[{"source":"amazon-inspector","versions":["1.0.12"],"id":"IN-MAL-2026-004182","import_time":"2026-05-26T05:52:05.839568774Z","modified_time":"2026-05-22T09:56:48Z","sha256":"53fb816939bb505cdabc374418983428298b09a29e5789033943301642b8b156"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@thebros/create-benjamin/v/1.0.12"}],"affected":[{"package":{"name":"@thebros/create-benjamin","ecosystem":"npm","purl":"pkg:npm/%40thebros%2Fcreate-benjamin"},"versions":["1.0.12"],"database_specific":{"indicators":{"package_integrity":[{"hashes":{"sha1":"a34a6fdc991963e8d4fae97583cbfd397afad3e7","sha512_sri":"sha512-+Tp76Nf4KInSbX/MPBtLeIpgUjFP4RLTf+gF9LwvzCLyrNfyoWSDOk1Ycr0JoZNQ/3V7T58KTY/G2axHyFSw/Q=="},"filename":"create-benjamin-1.0.12.tgz"}],"evidence_files":[{"path":".env","sha256":"dee487b5dd4667c91c0e4671ea7ea41c6303a0a1e8a962b9cc17b569b7742aa3","tlsh":"fec080a9958c344558dc1d111d38b4f6172d7c1d20d2ad7336d3d0d675480104df051c"}]},"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/withdrawn/npm/@thebros/create-benjamin/MAL-2026-4455.json"}}],"schema_version":"1.7.5","credits":[{"name":"Amazon Inspector","contact":["actran@amazon.com"],"type":"FINDER"}]}