{"id":"MAL-2026-6699","summary":"Malicious code in ecto-corsair-flag-7kq3mz (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (2a4dfa9f4805e5b44c7ccf3e4c3859abf8e9f0388f11e3daf6065f43c49e09ed)\nPackage wires preinstall, install, and postinstall lifecycle hooks to run postinstall.js, which executes unconditionally on npm install. The script collects hostname, cwd, uid, and environment variables matching FLAG/CTF/NPM/REGISTRY/CI/GITHUB/RUNNER, reads candidate flag files, and uses child_process.execSync to recursively grep installer-side directories (/app, /workspace, /challenge, /home/runner/work/repo/repo,.,..,../..) for flag-shaped strings. The collected manifest is base64-encoded and PUT to http://154.57.164.76:30728/api/modules/\u003cid\u003e, with an additional GET beacon to webhook.site/755defab-ea42-4c1f-9804-43ec567439f5. postinstall.js also tests npm_config_registry against /verdaccio/i to detect successful dependency-confusion landings, and the shipped publish-and-arm.sh and README self-describe the package as an 'armed' dependency-confusion probe. Regardless of the CTF/probe framing, installing this package causes unconsented exfiltration of installer environment and filesystem contents to an attacker-controlled IP.\n","modified":"2026-06-30T21:46:46.226074555Z","published":"2026-06-30T21:00:23Z","database_specific":{"malicious-packages-origins":[{"versions":["1.0.2"],"import_time":"2026-06-30T21:35:50.716175169Z","id":"IN-MAL-2026-007821","sha256":"2a4dfa9f4805e5b44c7ccf3e4c3859abf8e9f0388f11e3daf6065f43c49e09ed","source":"amazon-inspector","modified_time":"2026-06-30T21:00:23Z"},{"versions":["1.0.0"],"import_time":"2026-06-30T21:35:50.814129246Z","id":"IN-MAL-2026-007822","sha256":"54d9460656276821368471252c6a7b1c42dc2fdfd89432aa796d71d5463a1fc7","source":"amazon-inspector","modified_time":"2026-06-30T21:00:30Z"},{"versions":["1.0.1"],"import_time":"2026-06-30T21:35:50.916792534Z","id":"IN-MAL-2026-007823","sha256":"b18aadaf5087b19b63d12456642141e5bfff9146bf1bf4fcfb11eed833b8c78c","modified_time":"2026-06-30T21:00:38Z","source":"amazon-inspector"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/ecto-corsair-flag-7kq3mz/v/1.0.2"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/ecto-corsair-flag-7kq3mz/v/1.0.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/ecto-corsair-flag-7kq3mz/v/1.0.1"}],"affected":[{"package":{"name":"ecto-corsair-flag-7kq3mz","ecosystem":"npm","purl":"pkg:npm/ecto-corsair-flag-7kq3mz"},"versions":["1.0.2","1.0.0","1.0.1"],"database_specific":{"indicators":{"package_integrity":[{"filename":"ecto-corsair-flag-7kq3mz-1.0.2.tgz","hashes":{"sha1":"b38b01ea5ee92d0c53120e122137a7fb672431f3","sha512_sri":"sha512-PKRdQchYOdl1qlXamo4BYdDyC8dCsdiaq6A/c1dJ2qJgvMSKoviVFO7SvWsKLAdBFC4i4VY9Is6f8Nn314BzCg=="}}],"evidence_files":[{"path":"postinstall.js","tlsh":"3781a59dbbf594a501d5b9846217640bbeefd627352eacd07a8c03f02fdc1b810b169d","sha256":"9ca7a71fe48ba9a34e4e71ee46a5e39d0b189a1cf9e3406e7b2d4b7e9888ca19"},{"tlsh":"1431a68b71357173806ddb55b900533217f3b6ab672fb811e8dd34ed135a0f6a27a006","path":"publish-and-arm.sh","sha256":"914443bf677378da4945a821de28a7c91db637e39e275a3b30ee317b179e47cf"}]},"cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."},{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."},{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/ecto-corsair-flag-7kq3mz/MAL-2026-6699.json"}}],"schema_version":"1.7.5","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}