{"id":"MAL-2026-6700","summary":"Malicious code in module-index-cache (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (d3b789fbaaf21d9554aa580105d73d992d4a82963e1ade3c6dca6290f5cd7a3e)\npackage.json declares preinstall, install, and postinstall hooks that all invoke install.js, so the payload runs unconditionally on `npm install`. install.js reads installer-side secrets and host data — /app/.env, /root/.npmrc, /home/node/.npmrc, /etc/npmrc, /app/.git/config, package.json, /proc/self/environ, and the full process.env (JSON-stringified, sliced to 15000 chars) — runs shell reconnaissance (id, hostname, whoami, ls, ps, find/grep for flag files), base64-encodes the bundle, and POSTs/PUTs it via http.request to the hardcoded endpoint http://154.57.164.76:30728/api/modules/ECT-839201. The tarball additionally ships publish-and-arm.sh and arm-aliases.sh, which document and automate publishing the package under aliases (curse-dependent, spectral-corsair, @spectral-corsair/cursed-modules) using `npm:module-index-cache@1.0.2` redirection — explicitly labeled `dependency-confusion` and `armed-alias-public-npm` — to weaponize name confusion against private-registry consumers. A CTF/cover-story framing in comments does not change the installer impact: any machine that installs this package leaks its environment variables, npm auth tokens, dotenv contents, git configuration, and selected source/filesystem data to an attacker-controlled host.\n","modified":"2026-06-30T21:46:37.745060913Z","published":"2026-06-30T21:00:00Z","database_specific":{"malicious-packages-origins":[{"modified_time":"2026-06-30T21:00:08Z","source":"amazon-inspector","import_time":"2026-06-30T21:35:50.443857523Z","sha256":"9a947e4f5dba43d2cfe0428514bf4a787fc8f3d538fe5482b54508cc1c732099","versions":["1.0.1"],"id":"IN-MAL-2026-007819"},{"id":"IN-MAL-2026-007818","source":"amazon-inspector","import_time":"2026-06-30T21:35:50.324911778Z","sha256":"cf55b479f7a8b550b2c5661e990f8cb3cff0d6c25886da004ada85d401f39372","versions":["1.0.0"],"modified_time":"2026-06-30T21:00:00Z"},{"id":"IN-MAL-2026-007820","source":"amazon-inspector","import_time":"2026-06-30T21:35:50.597601082Z","sha256":"d3b789fbaaf21d9554aa580105d73d992d4a82963e1ade3c6dca6290f5cd7a3e","versions":["1.0.2"],"modified_time":"2026-06-30T21:00:15Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/module-index-cache/v/1.0.1"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/module-index-cache/v/1.0.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/module-index-cache/v/1.0.2"}],"affected":[{"package":{"name":"module-index-cache","ecosystem":"npm","purl":"pkg:npm/module-index-cache"},"versions":["1.0.1","1.0.0","1.0.2"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/module-index-cache/MAL-2026-6700.json","indicators":{"package_integrity":[{"filename":"module-index-cache-1.0.1.tgz","hashes":{"sha1":"0d7832df4f45f5c5499926e64f133a52ac022e2f","sha512_sri":"sha512-sFR9HBbqg+DKTzHUtPEP9jxI029YDM1xO4h+ZA69YVi1TplWvrtz3gk4/B0ldXdNtXf2b0YT2Ue9TFBiM5iaEA=="}}],"evidence_files":[{"sha256":"5a4125c2c23ce80a01b1b8c311fcc2512712bff48849d06cce88a6895c191482","tlsh":"7f81d7d9fef9811273e8b95536a64403bee7e67324197c903c491ad03fcc8ad02325ab","path":"install.js"},{"sha256":"597031dcb0a3e14212126e85b226c068bf3bf3e822488bc6f0710812dc551c72","tlsh":"2e114683643a70b3c48fab81f504533157f7b5eb241b3520ddcc35e927aa1fd926916a","path":"publish-and-arm.sh"}]},"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}]}}],"schema_version":"1.7.5","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}