{"id":"MAL-2026-5779","summary":"Malicious code in hemi-supply-cron (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (c41be27601d38eb5c0b527a9ec22b7516734e8eae985a2607ae6d70878f5f1d9)\npackage.json declares a preinstall hook (`node postinstall.js`) that fires automatically on `npm install`. The script collects host identity (os.hostname(), os.userInfo().username, process.cwd()) and enumerates process.env, filtering keys against the regex /key|secret|token|pass|private|ssh|deploy|auth|api|rpc|wallet|sentry|docker|graph|slack|host/i to harvest any credential-shaped variables (AWS keys, SSH/deploy tokens, RPC/wallet secrets, API tokens, etc.). The collected JSON payload is HTTPS POSTed to the hardcoded bare IP 185.130.46.35:8443 at path /collect. The package has no library functionality — `index.js` exports an empty object — and is published at version 999.0.0, the canonical dependency-confusion shape used to override an internal package name with a higher public version. The package's sole purpose is to harvest installer/CI secrets.\n","modified":"2026-07-23T07:51:37.803552455Z","published":"2026-06-15T15:09:34Z","database_specific":{"malicious-packages-origins":[{"modified_time":"2026-06-15T15:09:34Z","versions":["999.0.0"],"source":"amazon-inspector","sha256":"c41be27601d38eb5c0b527a9ec22b7516734e8eae985a2607ae6d70878f5f1d9","import_time":"2026-06-15T15:30:21.985585115Z","id":"IN-MAL-2026-006486"},{"source":"reversing-labs","sha256":"0fe7117c9f4a8e62b325c7f04932fad18bded6a59b2b642a01723f049efacbee","import_time":"2026-07-20T13:14:47.484940688Z","id":"RLMA-2026-05552","modified_time":"2026-07-20T10:46:08Z","versions":["999.0.0"]}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/hemi-supply-cron/v/999.0.0"}],"affected":[{"package":{"name":"hemi-supply-cron","ecosystem":"npm","purl":"pkg:npm/hemi-supply-cron"},"versions":["999.0.0"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/hemi-supply-cron/MAL-2026-5779.json","cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}],"indicators":{"evidence_files":[{"sha256":"d64656e6553409a54557222ecca0d2d914ac89afab42f95780168653327962f3","tlsh":"ef0141f884ed95a226e797d8f117901761bbd2323d0678b0baa842851fcc27485f2cf2","path":"postinstall.js"},{"sha256":"40e334223e5575864b28d5c3b5c5f38992e1ffe22a985f335a17cfd7f73a5a98","tlsh":"2bc01274cd1557731cc40ba595a2850975a11d2b6004a85857c3149442aa77658ab70d","path":"package.json"}],"package_integrity":[{"filename":"hemi-supply-cron-999.0.0.tgz","hashes":{"sha1":"691a21e5381d0fdbcfe1f1991b236f7056ecddc3","sha512_sri":"sha512-Pm9i/tW3FBO94QoX54K9ilVW4hG5gaWQLekKJ8wDxpacy8CVZNFmheLx/ANBY7XuAcG/KP3hetRTuL9XQZdVdw=="}}]}}}],"schema_version":"1.7.5","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"ReversingLabs","contact":["https://www.reversinglabs.com"],"type":"FINDER"}]}