MAL-2026-14372

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/create-coin/MAL-2026-14372.json
JSON Data
https://api.test.osv.dev/v1/vulns/MAL-2026-14372
Published
2026-08-23T03:15:07Z
Modified
2026-08-23T03:30:20.132593117Z
Summary
Malicious code in create-coin (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (d92da1d80f455caae769107e4b3ff99c003a296f1238728cfc5521d5be06c380)

Package create-coin@20.1.1 registers a postinstall hook that runs build/payload.node.js during npm install. The script performs anti-analysis guards (bails out on CI/GitHub Actions env vars, /.dockerenv, container cgroups, or fewer than four environment variables), sleeps a randomized 10-30 seconds, then reads the installer's ~/.npmrc (or %USERPROFILE%.npmrc), enumerates every process.env entry, and reads project files including package.json, package-lock.json,.env, and src/config.*. It also collects host reconnaissance via os.hostname(), os.userInfo(), and child_process output of uname/id, plus open localhost port probes. All collected data is POSTed over HTTPS to the hardcoded endpoint https://random-name.trycloudflare.com with rejectUnauthorized:false, and a.ran lock file is written for idempotency. Exceptions are swallowed and exit code is forced to 0 so npm install appears successful. The package.json description claims the package is a "netbsd-x64 build for esbuild" while the shipped code has no relationship to esbuild, indicating typosquat / platform-package impersonation of the esbuild family.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-018572",
            "sha256": "d92da1d80f455caae769107e4b3ff99c003a296f1238728cfc5521d5be06c380",
            "modified_time": "2026-08-23T03:15:07Z",
            "versions": [
                "20.1.1"
            ],
            "import_time": "2026-08-23T03:25:56.486359813Z",
            "source": "amazon-inspector"
        }
    ]
}
References
Credits

Affected packages

npm / create-coin

Package

Name
create-coin
View open source insights on deps.dev
Purl
pkg:npm/create-coin

Affected ranges

Affected versions

20.*
20.1.1

Database specific

indicators 
{
    "evidence_files": [
        {
            "sha256": "9653b29051064bf5d0adf870033b496b49406e14c58b07480a15ebc0c2ebe80b",
            "path": "build/payload.node.js",
            "tlsh": "bcb122da5aea21717a23b1b6466f10097177e2530286dad4bc9cd1419fb0b78236acfc"
        },
        {
            "sha256": "5d0cb9cd0e95c389679840a799d1ff5b4dd7d83bd7b28d97efaf1f9e227688c5",
            "path": "package.json",
            "tlsh": "2de0c2304a10592336c85a991c79864ae6728c3748817804279b115886ab2ba24bf66e"
        }
    ],
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-XQ5fY7VVinbK6ghueipMvrTVqUaUoM2utCG+F9XeukZXJMNE/LbigHPnx7JlGJenvw3efJDxwRw0wVM+ziJqdA==",
                "sha1": "d288569563bd81f59ee9fce96a2857502e7735c1"
            },
            "filename": "create-coin-20.1.1.tgz"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/create-coin/MAL-2026-14372.json"
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]