{"id":"MAL-2026-6240","summary":"Malicious code in atlasora-sdk (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (cc75492c0a0ce4090918bfdef0cea9cc028ef4c8273283d32085189e13a59c51)\nPackage ships a postinstall hook (`package.json` scripts.postinstall: `node install.js`) that runs automatically on every `npm install`. install.js reads classic installer-secret paths — `~/.ssh/*` (any file containing 'PRIVATE' or 'KEY'), `~/.aws/credentials`, `~/.npmrc`, and `.env` / `.env.local` / `.env.production` from the working directory — and bulk-scrapes 30+ environment variables shaped like credentials (PRIVATE_KEY, AWS_SECRET_ACCESS_KEY, JWT_SECRET, COINBASE_*, SUPABASE_SERVICE_ROLE_KEY, ANTHROPIC_*, etc.), plus host identity (`os.hostname()`, `os.userInfo()`, `git config --list`). The collected bundle is POSTed as JSON over HTTPS to a hardcoded anonymous webhook.site collection URL stored in a variable literally named `EXFIL_SERVER`. The package's `index.js` exports only a stub `{version, name}` — there is no real SDK functionality, despite the package name and description claiming to be the AtlasOra Web3 vacation-rental SDK. This is a brand-impersonation credential harvester targeting AtlasOra developers; any machine that runs `npm install atlasora-sdk` is fully compromised.\n","modified":"2026-06-20T13:46:43.345123784Z","published":"2026-06-20T13:10:04Z","database_specific":{"malicious-packages-origins":[{"versions":["1.0.0"],"id":"IN-MAL-2026-007095","import_time":"2026-06-20T13:37:51.096929851Z","modified_time":"2026-06-20T13:10:04Z","sha256":"cc75492c0a0ce4090918bfdef0cea9cc028ef4c8273283d32085189e13a59c51","source":"amazon-inspector"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/atlasora-sdk/v/1.0.0"}],"affected":[{"package":{"name":"atlasora-sdk","ecosystem":"npm","purl":"pkg:npm/atlasora-sdk"},"versions":["1.0.0"],"database_specific":{"cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}],"indicators":{"evidence_files":[{"sha256":"5849f99b3c22a51b079d3d793718c0b48cde0e1c6ed7d7738edaf87e8e01eb88","tlsh":"887175a180f6026056d33ae7e58f24252215f153be12eed43ddc12519f8a62c86f2bff","path":"install.js"},{"path":"package.json","sha256":"ed16e06ab530ba4350d163f647d56809eb21341b51f144e72a6294ea17e09d74","tlsh":"63e0ed70aa2188736acda6ac4962910572219a4fc448a81c3acb305cc3ce73609fea2d"}],"package_integrity":[{"filename":"atlasora-sdk-1.0.0.tgz","hashes":{"sha1":"34d39b2d85bbb34887e11b01c09d9423773d5e6b","sha512_sri":"sha512-ZZHoFUsPvsssExd3X4JSPXhYuGZG8rs1ou3eobJJ9TBiygJlUgcbEp63uBmaxk4uObRXrUqRDpgC2jGOniqclQ=="}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/atlasora-sdk/MAL-2026-6240.json"}}],"schema_version":"1.7.5","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}