MAL-2026-6700

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/module-index-cache/MAL-2026-6700.json
JSON Data
https://api.test.osv.dev/v1/vulns/MAL-2026-6700
Published
2026-06-30T21:00:00Z
Modified
2026-06-30T21:46:37.745060913Z
Summary
Malicious code in module-index-cache (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (d3b789fbaaf21d9554aa580105d73d992d4a82963e1ade3c6dca6290f5cd7a3e)

package.json declares preinstall, install, and postinstall hooks that all invoke install.js, so the payload runs unconditionally on npm install. install.js reads installer-side secrets and host data — /app/.env, /root/.npmrc, /home/node/.npmrc, /etc/npmrc, /app/.git/config, package.json, /proc/self/environ, and the full process.env (JSON-stringified, sliced to 15000 chars) — runs shell reconnaissance (id, hostname, whoami, ls, ps, find/grep for flag files), base64-encodes the bundle, and POSTs/PUTs it via http.request to the hardcoded endpoint http://154.57.164.76:30728/api/modules/ECT-839201. The tarball additionally ships publish-and-arm.sh and arm-aliases.sh, which document and automate publishing the package under aliases (curse-dependent, spectral-corsair, @spectral-corsair/cursed-modules) using npm:module-index-cache@1.0.2 redirection — explicitly labeled dependency-confusion and armed-alias-public-npm — to weaponize name confusion against private-registry consumers. A CTF/cover-story framing in comments does not change the installer impact: any machine that installs this package leaks its environment variables, npm auth tokens, dotenv contents, git configuration, and selected source/filesystem data to an attacker-controlled host.

Database specific 
{
    "malicious-packages-origins": [
        {
            "source": "amazon-inspector",
            "sha256": "9a947e4f5dba43d2cfe0428514bf4a787fc8f3d538fe5482b54508cc1c732099",
            "modified_time": "2026-06-30T21:00:08Z",
            "versions": [
                "1.0.1"
            ],
            "id": "IN-MAL-2026-007819",
            "import_time": "2026-06-30T21:35:50.443857523Z"
        },
        {
            "source": "amazon-inspector",
            "versions": [
                "1.0.0"
            ],
            "id": "IN-MAL-2026-007818",
            "modified_time": "2026-06-30T21:00:00Z",
            "sha256": "cf55b479f7a8b550b2c5661e990f8cb3cff0d6c25886da004ada85d401f39372",
            "import_time": "2026-06-30T21:35:50.324911778Z"
        },
        {
            "source": "amazon-inspector",
            "sha256": "d3b789fbaaf21d9554aa580105d73d992d4a82963e1ade3c6dca6290f5cd7a3e",
            "id": "IN-MAL-2026-007820",
            "modified_time": "2026-06-30T21:00:15Z",
            "versions": [
                "1.0.2"
            ],
            "import_time": "2026-06-30T21:35:50.597601082Z"
        }
    ]
}
References
Credits

Affected packages

npm / module-index-cache

Package

Name
module-index-cache
View open source insights on deps.dev
Purl
pkg:npm/module-index-cache

Affected ranges

Affected versions

1.*
1.0.0
1.0.1
1.0.2

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/module-index-cache/MAL-2026-6700.json"
indicators 
{
    "evidence_files": [
        {
            "tlsh": "7f81d7d9fef9811273e8b95536a64403bee7e67324197c903c491ad03fcc8ad02325ab",
            "sha256": "5a4125c2c23ce80a01b1b8c311fcc2512712bff48849d06cce88a6895c191482",
            "path": "install.js"
        },
        {
            "tlsh": "2e114683643a70b3c48fab81f504533157f7b5eb241b3520ddcc35e927aa1fd926916a",
            "sha256": "597031dcb0a3e14212126e85b226c068bf3bf3e822488bc6f0710812dc551c72",
            "path": "publish-and-arm.sh"
        }
    ],
    "package_integrity": [
        {
            "filename": "module-index-cache-1.0.1.tgz",
            "hashes": {
                "sha512_sri": "sha512-sFR9HBbqg+DKTzHUtPEP9jxI029YDM1xO4h+ZA69YVi1TplWvrtz3gk4/B0ldXdNtXf2b0YT2Ue9TFBiM5iaEA==",
                "sha1": "0d7832df4f45f5c5499926e64f133a52ac022e2f"
            }
        }
    ]
}
cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]