MAL-2026-18376: Malicious code in black-spindle-2 (npm)

Published Oct 29, 2026

Updated

--- -= Per source details. Do not edit below this line.=-

Source: amazon-inspector (433228fbed18f3104fed4cd1bce59bc5a76b8ea061d18c8fc9516c92b6b26e90) package.json declares a postinstall script that runs curl against the ephemeral host http://778e-181-63-25-28.ngrok-free.app over plain HTTP, embedding a shell command-substitution expression in the URL path. The script fires automatically on npm install, confirming installation on the installer's machine and providing a channel to exfiltrate host or environment values via the expanded shell expression. The shipped index.js is an empty stub, so the manifest's postinstall beacon is the package's entire effect. The destination is an anonymous ngrok-free.app tunnel with no relationship to any legitimate publisher, consistent with a dependency-confusion or install-confirmation probe.

Affected Software

1 affected component

npm/black-spindle-2=301.0.0, =100.0.0

Event History

Oct 29, 2026

Advisory Published

via OSV·02:59 PM

Data Sourced

via OSV·02:59 PM

DescriptionAffected Software

Frequently Asked Questions

Which environments are exposed to the install-time behavior?

Any machine on which npm installs black-spindle-2 and runs its postinstall lifecycle script is exposed. The script runs automatically during npm install and sends a request to the specified ngrok-free.app host over plain HTTP.

What does an attacker need to exploit this?

The package only needs to be installed in an npm environment that executes postinstall scripts. No application use of the package is required, because the shipped index.js is empty and the manifest script is the package's effective behavior.

Is a default npm installation affected?

Yes, the reported postinstall script fires automatically on npm install. This makes installations affected even if the application never imports or calls black-spindle-2.

How can I check whether a copy is affected?

Inspect the installed package's package.json for a postinstall script that invokes curl to http://778e-181-63-25-28.ngrok-free.app and includes shell command substitution in the URL path. The referenced package versions include 301.0.0 and 100.0.0.

What should be done if the package is present?

Remove or avoid installing black-spindle-2, since its stated functionality is an empty index.js while its meaningful behavior is the install-time beacon. Treat machines where it was installed as having potentially sent installation or host/environment-derived values to the remote endpoint.

MAL-2026-18376: Malicious code in black-spindle-2 (npm)

Affected Software

Event History

Frequently Asked Questions

Which environments are exposed to the install-time behavior?

What does an attacker need to exploit this?

Is a default npm installation affected?

How can I check whether a copy is affected?

What should be done if the package is present?

Company

Resources

Contact

Frequently Asked Questions

Which environments are exposed to the install-time behavior?

What does an attacker need to exploit this?

Is a default npm installation affected?

How can I check whether a copy is affected?

What should be done if the package is present?