{"id":"MAL-2026-6701","summary":"Malicious code in ripshakti (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (aa7ce8c4b0c7a25d70f9043d4208694cdef5ad174aa493ee9e9097ea6693a668)\nThe package's preinstall lifecycle hook (scripts.preinstall = \"node index.js\") auto-executes index.js on `npm install`. The script queries the AWS instance metadata service at 169.254.169.254 for IAM security credentials, instance identity, user-data and network metadata, reads ECS container credentials endpoints, and enumerates process.env filtering for keys matching /key|secret|token|pass|auth|cred|api|aws|database|db_|mongo|redis|s3|sqs|sns|lambda|role/i. Collected data is base64-encoded and POSTed to a hardcoded out-of-band collector at https://9x7dxkrzy9hpff6ds3y1umla218swik7.oastify.com. Any developer, CI runner, or EC2/ECS host that runs `npm install` for this package has its cloud IAM role credentials and environment secrets exfiltrated to an attacker-controlled endpoint.\n","modified":"2026-06-30T21:46:37.855454416Z","published":"2026-06-30T20:59:31Z","database_specific":{"malicious-packages-origins":[{"source":"amazon-inspector","modified_time":"2026-06-30T20:59:31Z","import_time":"2026-06-30T21:35:49.94984278Z","id":"IN-MAL-2026-007816","versions":["80.0.0"],"sha256":"aa7ce8c4b0c7a25d70f9043d4208694cdef5ad174aa493ee9e9097ea6693a668"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/ripshakti/v/80.0.0"}],"affected":[{"package":{"name":"ripshakti","ecosystem":"npm","purl":"pkg:npm/ripshakti"},"versions":["80.0.0"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/ripshakti/MAL-2026-6701.json","cwes":[{"name":"Embedded Malicious Code","description":"The product contains code that appears to be malicious in nature.","cweId":"CWE-506"}],"indicators":{"package_integrity":[{"filename":"ripshakti-80.0.0.tgz","hashes":{"sha1":"3edd94ed2d01565b96a4c8dc20a00f6c199ac8aa","sha512_sri":"sha512-u7w3sQT7RG8075trIm+zk8rGO6NJcjR4HvK8f6TMKOlauGRBpS/FLjQ5o8g5Lc6eHS1aRpOACMVE6wefbUpOEQ=="}}],"evidence_files":[{"tlsh":"6571614962fb51030c7789eed2dbf01a5626f0073a81de88b6fc0f440f85529b263ae9","path":"index.js","sha256":"89432734c409cc5f4492d1ec20e8b16d59fa81b7824b27241795f508e18e9597"},{"tlsh":"a7d05e345d61593315c506a6082ea446a6a1cf2f1408380993db183c91de67798ff35d","path":"package.json","sha256":"1c74b67aa4a798d14d6522e9183e6b1a8cc25b8df380c82398e4b265e08efbe9"}]}}}],"schema_version":"1.7.5","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}