MAL-2026-6701

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/ripshakti/MAL-2026-6701.json
JSON Data
https://api.test.osv.dev/v1/vulns/MAL-2026-6701
Published
2026-06-30T20:59:31Z
Modified
2026-06-30T21:46:37.855454416Z
Summary
Malicious code in ripshakti (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (aa7ce8c4b0c7a25d70f9043d4208694cdef5ad174aa493ee9e9097ea6693a668)

The package's preinstall lifecycle hook (scripts.preinstall = "node index.js") auto-executes index.js on npm install. The script queries the AWS instance metadata service at 169.254.169.254 for IAM security credentials, instance identity, user-data and network metadata, reads ECS container credentials endpoints, and enumerates process.env filtering for keys matching /key|secret|token|pass|auth|cred|api|aws|database|db_|mongo|redis|s3|sqs|sns|lambda|role/i. Collected data is base64-encoded and POSTed to a hardcoded out-of-band collector at https://9x7dxkrzy9hpff6ds3y1umla218swik7.oastify.com. Any developer, CI runner, or EC2/ECS host that runs npm install for this package has its cloud IAM role credentials and environment secrets exfiltrated to an attacker-controlled endpoint.

Database specific 
{
    "malicious-packages-origins": [
        {
            "source": "amazon-inspector",
            "sha256": "aa7ce8c4b0c7a25d70f9043d4208694cdef5ad174aa493ee9e9097ea6693a668",
            "id": "IN-MAL-2026-007816",
            "versions": [
                "80.0.0"
            ],
            "modified_time": "2026-06-30T20:59:31Z",
            "import_time": "2026-06-30T21:35:49.94984278Z"
        }
    ]
}
References
Credits

Affected packages

npm / ripshakti

Package

Name
ripshakti
View open source insights on deps.dev
Purl
pkg:npm/ripshakti

Affected ranges

Affected versions

80.*
80.0.0

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/ripshakti/MAL-2026-6701.json"
indicators 
{
    "evidence_files": [
        {
            "tlsh": "6571614962fb51030c7789eed2dbf01a5626f0073a81de88b6fc0f440f85529b263ae9",
            "sha256": "89432734c409cc5f4492d1ec20e8b16d59fa81b7824b27241795f508e18e9597",
            "path": "index.js"
        },
        {
            "tlsh": "a7d05e345d61593315c506a6082ea446a6a1cf2f1408380993db183c91de67798ff35d",
            "sha256": "1c74b67aa4a798d14d6522e9183e6b1a8cc25b8df380c82398e4b265e08efbe9",
            "path": "package.json"
        }
    ],
    "package_integrity": [
        {
            "filename": "ripshakti-80.0.0.tgz",
            "hashes": {
                "sha512_sri": "sha512-u7w3sQT7RG8075trIm+zk8rGO6NJcjR4HvK8f6TMKOlauGRBpS/FLjQ5o8g5Lc6eHS1aRpOACMVE6wefbUpOEQ==",
                "sha1": "3edd94ed2d01565b96a4c8dc20a00f6c199ac8aa"
            }
        }
    ]
}
cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]