{"id":"MAL-2026-5779","summary":"Malicious code in hemi-supply-cron (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (c41be27601d38eb5c0b527a9ec22b7516734e8eae985a2607ae6d70878f5f1d9)\npackage.json declares a preinstall hook (`node postinstall.js`) that fires automatically on `npm install`. The script collects host identity (os.hostname(), os.userInfo().username, process.cwd()) and enumerates process.env, filtering keys against the regex /key|secret|token|pass|private|ssh|deploy|auth|api|rpc|wallet|sentry|docker|graph|slack|host/i to harvest any credential-shaped variables (AWS keys, SSH/deploy tokens, RPC/wallet secrets, API tokens, etc.). The collected JSON payload is HTTPS POSTed to the hardcoded bare IP 185.130.46.35:8443 at path /collect. The package has no library functionality — `index.js` exports an empty object — and is published at version 999.0.0, the canonical dependency-confusion shape used to override an internal package name with a higher public version. The package's sole purpose is to harvest installer/CI secrets.\n","aliases":["GHSA-49hx-4cwp-rqgh"],"modified":"2026-09-01T11:31:32.674573793Z","published":"2026-06-15T15:09:34Z","database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-006486","import_time":"2026-06-15T15:30:21.985585115Z","modified_time":"2026-06-15T15:09:34Z","sha256":"c41be27601d38eb5c0b527a9ec22b7516734e8eae985a2607ae6d70878f5f1d9","source":"amazon-inspector","versions":["999.0.0"]},{"sha256":"0fe7117c9f4a8e62b325c7f04932fad18bded6a59b2b642a01723f049efacbee","source":"reversing-labs","versions":["999.0.0"],"id":"RLMA-2026-05552","import_time":"2026-07-20T13:14:47.484940688Z","modified_time":"2026-07-20T10:46:08Z"},{"source":"reversing-labs","id":"RLUA-2026-06270","import_time":"2026-09-01T11:18:08.617210004Z","modified_time":"2026-08-24T16:54:41Z","sha256":"c80cb9b33c7f6d50f37db2104bc900c13478aecf9ef3f2724f63b34d000d42d2"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/hemi-supply-cron/v/999.0.0"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-49hx-4cwp-rqgh"}],"affected":[{"package":{"name":"hemi-supply-cron","ecosystem":"npm","purl":"pkg:npm/hemi-supply-cron"},"versions":["999.0.0"],"database_specific":{"cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}],"indicators":{"package_integrity":[{"hashes":{"sha1":"691a21e5381d0fdbcfe1f1991b236f7056ecddc3","sha512_sri":"sha512-Pm9i/tW3FBO94QoX54K9ilVW4hG5gaWQLekKJ8wDxpacy8CVZNFmheLx/ANBY7XuAcG/KP3hetRTuL9XQZdVdw=="},"filename":"hemi-supply-cron-999.0.0.tgz"}],"evidence_files":[{"tlsh":"ef0141f884ed95a226e797d8f117901761bbd2323d0678b0baa842851fcc27485f2cf2","path":"postinstall.js","sha256":"d64656e6553409a54557222ecca0d2d914ac89afab42f95780168653327962f3"},{"path":"package.json","sha256":"40e334223e5575864b28d5c3b5c5f38992e1ffe22a985f335a17cfd7f73a5a98","tlsh":"2bc01274cd1557731cc40ba595a2850975a11d2b6004a85857c3149442aa77658ab70d"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/hemi-supply-cron/MAL-2026-5779.json"}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"ReversingLabs","contact":["https://www.reversinglabs.com"],"type":"FINDER"}]}