MAL-2026-16078

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/cache-cleanup-module/MAL-2026-16078.json
JSON Data
https://api.test.osv.dev/v1/vulns/MAL-2026-16078
Published
2026-09-09T06:54:28Z
Modified
2026-09-09T07:30:07Z
Summary
Malicious code in cache-cleanup-module (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (2931c2feef07a63612b0886a1840e519516424af0fbf4fb0a138e97736a18857)

cache-cleanup-module ships an exported runOperation() that queries a hardcoded third-party endpoint at https://testback-2aqe.onrender.com/can-cleanup (authenticated with a static x-api-key token 'f8675764-417f-49a4-807c-5879a667c476') and, when the response contains allowed:true, recursively deletes every entry in the caller's current working directory (or a supplied path) via fs.rmSync({recursive:true, force:true}) and fs.unlinkSync, skipping only the module file itself. The package's stated purpose of 'safe, transparent cache and build artifact cleanup' is not reflected in the code: there is no filter restricting the deletion to cache or build artifact paths, so any consumer that invokes runOperation() has the entirety of their cwd wiped at the remote operator's discretion. The hardcoded endpoint and static API token give the author unilateral, per-install control over when destruction fires on installer machines.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-019848",
            "import_time": "2026-09-09T07:20:43.634581921Z",
            "modified_time": "2026-09-09T06:54:28Z",
            "sha256": "0ad7548a2f9d91783c5e21d77664d4d3991353fde3ec26e9480b0de7bf58cc68",
            "source": "amazon-inspector",
            "versions": [
                "2.6.0"
            ]
        },
        {
            "id": "IN-MAL-2026-019849",
            "import_time": "2026-09-09T07:20:43.748992885Z",
            "modified_time": "2026-09-09T06:54:37Z",
            "sha256": "2931c2feef07a63612b0886a1840e519516424af0fbf4fb0a138e97736a18857",
            "source": "amazon-inspector",
            "versions": [
                "2.5.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / cache-cleanup-module

Package

Name
cache-cleanup-module
View open source insights on deps.dev
Purl
pkg:npm/cache-cleanup-module

Affected ranges

Affected versions

2.*
2.5.0
2.6.0

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "index.js",
            "sha256": "fc68e4475765340483d69a4310e26b96cad1489a258d968f5a893185d5f0b1a6",
            "tlsh": "35610e88d85a631309b763a59b06180afe3912132719d215bebcd3d66f32c14f293dce"
        }
    ],
    "package_integrity": [
        {
            "filename": "cache-cleanup-module-2.6.0.tgz",
            "hashes": {
                "sha1": "9d818d4ed7f44afd1d7a5a84cb63a2d27a195d36",
                "sha512_sri": "sha512-vmsT1+LJWn4sQTrReQAqsEv7nRB+vvIpEGzElR4+KgJD7tmgzpZpwhvyqJvSoHernyrwLzb9UYVdh6pCO9bucA=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/cache-cleanup-module/MAL-2026-16078.json"