{"id":"MAL-2026-6700","summary":"Malicious code in module-index-cache (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (d3b789fbaaf21d9554aa580105d73d992d4a82963e1ade3c6dca6290f5cd7a3e)\npackage.json declares preinstall, install, and postinstall hooks that all invoke install.js, so the payload runs unconditionally on `npm install`. install.js reads installer-side secrets and host data — /app/.env, /root/.npmrc, /home/node/.npmrc, /etc/npmrc, /app/.git/config, package.json, /proc/self/environ, and the full process.env (JSON-stringified, sliced to 15000 chars) — runs shell reconnaissance (id, hostname, whoami, ls, ps, find/grep for flag files), base64-encodes the bundle, and POSTs/PUTs it via http.request to the hardcoded endpoint http://154.57.164.76:30728/api/modules/ECT-839201. The tarball additionally ships publish-and-arm.sh and arm-aliases.sh, which document and automate publishing the package under aliases (curse-dependent, spectral-corsair, @spectral-corsair/cursed-modules) using `npm:module-index-cache@1.0.2` redirection — explicitly labeled `dependency-confusion` and `armed-alias-public-npm` — to weaponize name confusion against private-registry consumers. A CTF/cover-story framing in comments does not change the installer impact: any machine that installs this package leaks its environment variables, npm auth tokens, dotenv contents, git configuration, and selected source/filesystem data to an attacker-controlled host.\n","modified":"2026-06-30T21:46:46.326919706Z","published":"2026-06-30T21:00:00Z","database_specific":{"malicious-packages-origins":[{"source":"amazon-inspector","import_time":"2026-06-30T21:35:50.443857523Z","modified_time":"2026-06-30T21:00:08Z","id":"IN-MAL-2026-007819","versions":["1.0.1"],"sha256":"9a947e4f5dba43d2cfe0428514bf4a787fc8f3d538fe5482b54508cc1c732099"},{"source":"amazon-inspector","import_time":"2026-06-30T21:35:50.324911778Z","modified_time":"2026-06-30T21:00:00Z","versions":["1.0.0"],"id":"IN-MAL-2026-007818","sha256":"cf55b479f7a8b550b2c5661e990f8cb3cff0d6c25886da004ada85d401f39372"},{"source":"amazon-inspector","import_time":"2026-06-30T21:35:50.597601082Z","modified_time":"2026-06-30T21:00:15Z","id":"IN-MAL-2026-007820","versions":["1.0.2"],"sha256":"d3b789fbaaf21d9554aa580105d73d992d4a82963e1ade3c6dca6290f5cd7a3e"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/module-index-cache/v/1.0.1"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/module-index-cache/v/1.0.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/module-index-cache/v/1.0.2"}],"affected":[{"package":{"name":"module-index-cache","ecosystem":"npm","purl":"pkg:npm/module-index-cache"},"versions":["1.0.1","1.0.0","1.0.2"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/module-index-cache/MAL-2026-6700.json","indicators":{"evidence_files":[{"tlsh":"7f81d7d9fef9811273e8b95536a64403bee7e67324197c903c491ad03fcc8ad02325ab","sha256":"5a4125c2c23ce80a01b1b8c311fcc2512712bff48849d06cce88a6895c191482","path":"install.js"},{"tlsh":"2e114683643a70b3c48fab81f504533157f7b5eb241b3520ddcc35e927aa1fd926916a","sha256":"597031dcb0a3e14212126e85b226c068bf3bf3e822488bc6f0710812dc551c72","path":"publish-and-arm.sh"}],"package_integrity":[{"hashes":{"sha1":"0d7832df4f45f5c5499926e64f133a52ac022e2f","sha512_sri":"sha512-sFR9HBbqg+DKTzHUtPEP9jxI029YDM1xO4h+ZA69YVi1TplWvrtz3gk4/B0ldXdNtXf2b0YT2Ue9TFBiM5iaEA=="},"filename":"module-index-cache-1.0.1.tgz"}]},"cwes":[{"cweId":"CWE-506","name":"Embedded Malicious Code","description":"The product contains code that appears to be malicious in nature."},{"cweId":"CWE-506","name":"Embedded Malicious Code","description":"The product contains code that appears to be malicious in nature."},{"cweId":"CWE-506","name":"Embedded Malicious Code","description":"The product contains code that appears to be malicious in nature."}]}}],"schema_version":"1.7.5","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}