{"id":"MAL-2026-7016","summary":"Malicious code in @vraksha/gh-helper (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (8c867b4c68acc159dea1bbd580c5de3f3c9fef7bd1f54cd48a02c59631ffda12)\nOn `npm install`, the package's postinstall hook runs index.js, which performs an HTTPS GET to https://http-logger-production.up.railway.app/payload, base64-decodes the response body (Buffer.from(data.trim(), 'base64').toString('utf-8')), and passes the decoded string to child_process.execSync with { shell: '/bin/bash' }. This is a fetch-decode-exec dropper: the executed content is attacker-controlled, mutable, and opaque, and it runs automatically at install time with the installer's privileges. No legitimate purpose (no shipped native source requiring a build, no vendor-matched SDK, no pinned artifact) justifies this pattern.\n","modified":"2026-07-08T18:46:45.783463042Z","published":"2026-07-08T18:08:50Z","database_specific":{"malicious-packages-origins":[{"source":"amazon-inspector","versions":["1.0.0"],"id":"IN-MAL-2026-008175","import_time":"2026-07-08T18:34:24.572459158Z","modified_time":"2026-07-08T18:08:50Z","sha256":"8c867b4c68acc159dea1bbd580c5de3f3c9fef7bd1f54cd48a02c59631ffda12"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@vraksha/gh-helper/v/1.0.0"}],"affected":[{"package":{"name":"@vraksha/gh-helper","ecosystem":"npm","purl":"pkg:npm/%40vraksha/gh-helper"},"versions":["1.0.0"],"database_specific":{"indicators":{"evidence_files":[{"tlsh":"0df005f4e6b862744b7298c82547ec5af543a02237c5fb9275dc10469f855f022fa3e8","path":"index.js","sha256":"943a5d8635002550096aa6c0fe76ed06316388485c13b2208a4c2676a5a660da"}],"package_integrity":[{"filename":"gh-helper-1.0.0.tgz","hashes":{"sha1":"f0b239079119267338eee4972294a88d3c8497c6","sha512_sri":"sha512-Gq74eZy7JVVsMKWgk7prFUIdmjKxdvEyuVtnLQk1DVI/GMnqVzkYYHh9XIjNozfZW+ohmzk5sSKe0bSRklOaoA=="}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@vraksha/gh-helper/MAL-2026-7016.json","cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}]}}],"schema_version":"1.7.5","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}