{"id":"MAL-2026-6699","summary":"Malicious code in ecto-corsair-flag-7kq3mz (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (2a4dfa9f4805e5b44c7ccf3e4c3859abf8e9f0388f11e3daf6065f43c49e09ed)\nPackage wires preinstall, install, and postinstall lifecycle hooks to run postinstall.js, which executes unconditionally on npm install. The script collects hostname, cwd, uid, and environment variables matching FLAG/CTF/NPM/REGISTRY/CI/GITHUB/RUNNER, reads candidate flag files, and uses child_process.execSync to recursively grep installer-side directories (/app, /workspace, /challenge, /home/runner/work/repo/repo,.,..,../..) for flag-shaped strings. The collected manifest is base64-encoded and PUT to http://154.57.164.76:30728/api/modules/\u003cid\u003e, with an additional GET beacon to webhook.site/755defab-ea42-4c1f-9804-43ec567439f5. postinstall.js also tests npm_config_registry against /verdaccio/i to detect successful dependency-confusion landings, and the shipped publish-and-arm.sh and README self-describe the package as an 'armed' dependency-confusion probe. Regardless of the CTF/probe framing, installing this package causes unconsented exfiltration of installer environment and filesystem contents to an attacker-controlled IP.\n","modified":"2026-06-30T21:46:37.555507336Z","published":"2026-06-30T21:00:23Z","database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-007821","source":"amazon-inspector","versions":["1.0.2"],"sha256":"2a4dfa9f4805e5b44c7ccf3e4c3859abf8e9f0388f11e3daf6065f43c49e09ed","import_time":"2026-06-30T21:35:50.716175169Z","modified_time":"2026-06-30T21:00:23Z"},{"sha256":"54d9460656276821368471252c6a7b1c42dc2fdfd89432aa796d71d5463a1fc7","versions":["1.0.0"],"source":"amazon-inspector","import_time":"2026-06-30T21:35:50.814129246Z","id":"IN-MAL-2026-007822","modified_time":"2026-06-30T21:00:30Z"},{"sha256":"b18aadaf5087b19b63d12456642141e5bfff9146bf1bf4fcfb11eed833b8c78c","versions":["1.0.1"],"source":"amazon-inspector","import_time":"2026-06-30T21:35:50.916792534Z","id":"IN-MAL-2026-007823","modified_time":"2026-06-30T21:00:38Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/ecto-corsair-flag-7kq3mz/v/1.0.2"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/ecto-corsair-flag-7kq3mz/v/1.0.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/ecto-corsair-flag-7kq3mz/v/1.0.1"}],"affected":[{"package":{"name":"ecto-corsair-flag-7kq3mz","ecosystem":"npm","purl":"pkg:npm/ecto-corsair-flag-7kq3mz"},"versions":["1.0.2","1.0.0","1.0.1"],"database_specific":{"indicators":{"package_integrity":[{"hashes":{"sha1":"b38b01ea5ee92d0c53120e122137a7fb672431f3","sha512_sri":"sha512-PKRdQchYOdl1qlXamo4BYdDyC8dCsdiaq6A/c1dJ2qJgvMSKoviVFO7SvWsKLAdBFC4i4VY9Is6f8Nn314BzCg=="},"filename":"ecto-corsair-flag-7kq3mz-1.0.2.tgz"}],"evidence_files":[{"path":"postinstall.js","sha256":"9ca7a71fe48ba9a34e4e71ee46a5e39d0b189a1cf9e3406e7b2d4b7e9888ca19","tlsh":"3781a59dbbf594a501d5b9846217640bbeefd627352eacd07a8c03f02fdc1b810b169d"},{"path":"publish-and-arm.sh","sha256":"914443bf677378da4945a821de28a7c91db637e39e275a3b30ee317b179e47cf","tlsh":"1431a68b71357173806ddb55b900533217f3b6ab672fb811e8dd34ed135a0f6a27a006"}]},"cwes":[{"name":"Embedded Malicious Code","description":"The product contains code that appears to be malicious in nature.","cweId":"CWE-506"},{"name":"Embedded Malicious Code","description":"The product contains code that appears to be malicious in nature.","cweId":"CWE-506"},{"name":"Embedded Malicious Code","description":"The product contains code that appears to be malicious in nature.","cweId":"CWE-506"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/ecto-corsair-flag-7kq3mz/MAL-2026-6699.json"}}],"schema_version":"1.7.5","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}