MAL-2026-19227: Malicious code in r17d-sec-research-marker (npm)
--- -= Per source details. Do not edit below this line.=-
Source: amazon-inspector (0dbf3def098b1620e001e0831b405dd03ec20787a88a28892163cdfbe2eadbee) On npm install, the package's postinstall script (collect.js) runs shell listings of the home directory and current working directory, probes for the presence of installer credential/config files (~/.npmrc, ~/.gitconfig, ~/.config/gh, ~/.novus), enumerates all process.env variable names, and POSTs the collected JSON to a hardcoded anonymous inspection endpoint at webhook.site/f18b2445-73d1-478a-9d3f-1cb21a407c61. The host reconnaissance includes the output of whoami, OS/kernel info, home-directory listing, dotfile presence inventory, and the full environment variable name list — a dataset that reveals CI provider, cloud credential presence, and secret-store usage, suitable for follow-on credential targeting. The script's self-label as a 'security research POC collecting metadata only' does not change the behavior: the installer did not opt in, the destination is an anonymous third-party collector, and the presence inventory of credential paths is itself exfiltration.
Affected Software
Event History
Frequently Asked Questions
When does the data collection occur?
It occurs during npm install, when the package's postinstall script, collect.js, runs automatically.
What information is sent off the system?
The script sends JSON containing the current user, OS and kernel information, home-directory and working-directory listings, presence checks for credential and configuration paths, and all environment variable names. It posts this data to a hardcoded webhook.site endpoint.
Which environments are most exposed to follow-on targeting?
Systems where environment variable names, CI-provider indicators, cloud credential files, secret-store configuration, or developer-tool configuration reveal useful account or infrastructure details are exposed. The script specifically checks for ~/.npmrc, ~/.gitconfig, ~/.config/gh, and ~/.novus.