MAL-2026-18375: Malicious code in @dmangal/curse-dependent-ecto (npm)

Published Oct 29, 2026

Updated

--- -= Per source details. Do not edit below this line.=-

Source: amazon-inspector (28b6b5c8c100680386dbcbbd51dd409f67f0d54701eb0e50232934acc53bf397) The package's binding.gyp contains a GYP command-expansion action that is executed automatically by node-gyp during npm install. The embedded node -e script runs grep -rl 'HTB{' /workspace/ /root/ /tmp/ /opt/ /var/ /etc/ across installer-side paths, reads /tmp/scent-trail.jsonl and /workspace/repo/package.json, enumerates every key of process.env and concatenates each key=value pair, and POSTs each of these payloads (prefixed GREP:, FILE:, ALLENV:) to the hardcoded attacker endpoint webhook.site/89bd8fe7-328c-4e6d-970c-4d567b5a48a0. The binding.gyp has no accompanying native source files; its only purpose is to run the embedded exfiltration command. The implausibly high version string (99999.0.1) is consistent with a dependency-confusion lure. Installing this package in a developer workstation or CI environment causes CI secrets, API tokens, and environment-injected credentials, along with workspace file contents and any file containing the HTB{ marker, to be transmitted to an attacker-controlled host.

Affected Software

1 affected component

npm/@dmangal/curse-dependent-ecto=99999.0.2, =99999.0.1, =99999.0.0

Event History

Oct 29, 2026

Advisory Published

via OSV·02:53 PM

Data Sourced

via OSV·02:53 PM

DescriptionAffected Software

Frequently Asked Questions

Who is most exposed to this package's behavior?

Developer workstations and CI environments that install the package are exposed, particularly where environment variables contain API tokens, CI secrets, or other injected credentials. The install-time command also searches workspace and system paths for files containing the HTB{ marker.

What triggers the malicious activity?

The embedded command is run automatically by node-gyp during npm install through a command-expansion action in binding.gyp. No native source build is required; the binding.gyp action exists solely to execute the exfiltration command.

What information is sent from an affected environment?

The command sends all process environment variable names and values, the contents of /tmp/scent-trail.jsonl and /workspace/repo/package.json, and results from searching /workspace/, /root/, /tmp/, /opt/, /var/, and /etc/ for HTB{. These payloads are POSTed to webhook.site/89bd8fe7-328c-4e6d-970c-4d567b5a48a0.

How can teams investigate possible exposure?

Identify installations of @dmangal/curse-dependent-ecto, including the referenced 99999.0.0, 99999.0.1, and 99999.0.2 package versions, and review install-time network telemetry for requests to webhook.site/89bd8fe7-328c-4e6d-970c-4d567b5a48a0. Environments where the package was installed should be treated as having potentially disclosed environment-injected credentials and the specified file contents.

MAL-2026-18375: Malicious code in @dmangal/curse-dependent-ecto (npm)

Affected Software

Event History

Frequently Asked Questions

Who is most exposed to this package's behavior?

What triggers the malicious activity?

What information is sent from an affected environment?

How can teams investigate possible exposure?

Company

Resources

Contact

Frequently Asked Questions

Who is most exposed to this package's behavior?

What triggers the malicious activity?

What information is sent from an affected environment?

How can teams investigate possible exposure?