MAL-2026-18605: Malicious code in babyyodaa (npm)
Runs on install. The preinstall script marks a shell script bundled in the package as executable and runs it; the script contains a reverse-shell pattern, giving a remote party a shell on the installing machine. Version examined: 1.1.0; tarball SHA-256 8321ef8b36b40d9a5b5ba649e9ad4ec3bcbe18a9a484075c5e8e5e872ec0db0b.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this package?
Any machine that installs the examined npm package version 1.1.0 is exposed because its preinstall script executes during installation. This includes development systems and build or deployment environments that install dependencies.
What does an attacker need to exploit this behavior?
The package only needs to be installed. Its preinstall script makes the bundled shell script executable and runs it, and that script contains a reverse-shell pattern that can provide a remote party shell access to the installing machine.
How can I determine whether the examined package artifact is present?
Check whether babyyodaa version 1.1.0 was installed and, where available, compare the package tarball SHA-256 to 8321ef8b36b40d9a5b5ba649e9ad4ec3bcbe18a9a484075c5e8e5e872ec0db0b.