{"id":"MAL-2026-6548","summary":"Malicious code in ts-ankle (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (1695e2ffa9252abe1053fc13895a071bd87cb27eb009eeb2262aae1a27da4ea5)\nOn `npm install`, ts-ankle@1.1.0 runs a `postinstall` hook (`node test.js`) that executes two hostile flows against the installer's machine without user interaction. (1) Credential harvest: the script recursively walks the user's home directory on Unix and every mounted drive on Windows, collects files matching credential patterns (`.env`, `.json`, `.toml`, `.pem`, `id.json`, etc.), and POSTs them as multipart form uploads to `https://datasecure-service.vercel.app/api/v1`. The scan and block patterns are fetched at install time from `/api/scan-patterns` and `/api/block-patterns` on the same host, letting the operator dynamically retarget which files are exfiltrated. (2) SSH backdoor: the script fetches an SSH public key from `/api/ssh-key` and, on Linux, appends it to `~/.ssh/authorized_keys`, chowns the directory via `sudo`, and runs `sudo ufw enable` + `sudo ufw allow 22/tcp` to ensure inbound SSH is reachable — granting the operator persistent remote access to the installer's host. The package's self-description as a backup/data-upload utility does not change the behavior: bulk credential-file harvest plus authorized_keys injection directed at a hardcoded author endpoint is supply-chain credential theft and remote backdoor installation.\n","modified":"2026-06-27T19:46:39.129983658Z","published":"2026-06-27T19:12:29Z","database_specific":{"malicious-packages-origins":[{"sha256":"1695e2ffa9252abe1053fc13895a071bd87cb27eb009eeb2262aae1a27da4ea5","versions":["1.1.0"],"id":"IN-MAL-2026-007684","ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"source":"amazon-inspector","modified_time":"2026-06-27T19:12:29Z","import_time":"2026-06-27T19:35:55.676156931Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/ts-ankle/v/1.1.0"}],"affected":[{"package":{"name":"ts-ankle","ecosystem":"npm","purl":"pkg:npm/ts-ankle"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"versions":["1.1.0"],"database_specific":{"indicators":{"package_integrity":[{"hashes":{"sha512_sri":"sha512-hatKIdEf6wwCtw5ebhjNZHl69PlEVRPAGT91OlXT04g0fDgH0Xcb0c94ldW2lMQhKVmzwdxLO1q7lL8CAEhJew==","sha1":"2f21fc8bbd48a5c59d43483e0d76da477e55a9c7"},"filename":"ts-ankle-1.1.0.tgz"}],"evidence_files":[{"sha256":"28a7cbf43fc7ea473a83f25e5449d25806c1902bc8b90c085e21b7da6e064073","path":"index.js","tlsh":"9c52a6aa10a67526c77127b8db074019ff27db6735224647f2bc42883f7212491e6fec"},{"sha256":"a92b142f2c0a13fefc056979d09c2abec7245a1cc1ce41b247f4eec97b8fd1b9","path":"package.json","tlsh":"92f0ed27ce598e6328f53aa8287c0627f6a1832f0204880f75bd661c8fb66234485f1e"}]},"cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/ts-ankle/MAL-2026-6548.json"}}],"schema_version":"1.7.5","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}