MAL-2026-18607: Malicious code in et_phone_home (npm)
Runs on install. The postinstall script fetches a path from a bare IPv4 address with wget, contacting a remote host from every machine that installs the package. Version examined: 0.0.5; tarball SHA-256 58f9b4c9c26abe6ac52353ce1e0a824fba06c8aa7cefa94d2d4805306053e82c.
Affected Software
Event History
Frequently Asked Questions
What systems are exposed to this package's behavior?
Any machine that installs the examined npm package version can contact the remote host, because the code runs through a postinstall script during installation.
What does an attacker need to trigger the network activity?
They only need the package to be installed on a target machine. The postinstall script invokes wget to fetch a path from a bare IPv4 address.
How can I determine whether I installed the examined artifact?
Check whether et_phone_home version 0.0.5 is present in your npm dependencies or lockfiles, and compare the package tarball SHA-256 to 58f9b4c9c26abe6ac52353ce1e0a824fba06c8aa7cefa94d2d4805306053e82c.