MAL-2026-19220: Malicious code in @securihackbot/depconf-flow-1792484611 (npm)
--- -= Per source details. Do not edit below this line.=-
Source: amazon-inspector (6dc8c3628b1d44eca51a5cde6143c1760a5d393b45729f174bab73f76f8641e8) Package publishes under the @securihackbot scope as a public dependency-confusion squat of an internal name. The declared postinstall script executes postinstall.js, which on npm install collects host identifiers (os.hostname(), USER/USERNAME, platform, arch, node version, package name, and a nonce), base64-encodes them, and sends them as a query parameter via plain-HTTP GET to a hardcoded bare-IP collector at http://34.143.131.27:18080/. A DNS-exfil fallback resolves NONCE-prefixed subdomains under a configured DNS suffix. The exfiltration fires automatically on install with no opt-in, and any build host whose resolver pulls this public tarball instead of an intended internal @securihackbot/ package will beacon host metadata to the hardcoded collector. The 'authorized research' framing in the README does not gate the behavior, which runs against any installer that resolves this version.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this package's behavior?
Build or development hosts are exposed if their dependency resolution retrieves this public package instead of an intended internal package in the @securihackbot scope. The behavior runs for any installer that resolves the affected package version.
Does exploitation require someone to run the installed package manually?
No. The declared postinstall script runs automatically during npm install, with no opt-in or interaction required after installation begins.
What information can leave an affected host?
The package collects the hostname, USER or USERNAME value, operating system platform, architecture, Node.js version, package name, and a nonce. It base64-encodes these values and transmits them to a hardcoded collector.
How is the collected data transmitted if the primary path is unavailable?
The primary transmission uses an unencrypted HTTP GET request to 34.143.131.27 on port 18080. The package also includes a DNS-exfiltration fallback using NONCE-prefixed subdomains under a configured DNS suffix.