MAL-2026-10604
Malicious code in @public-for-cdao/types (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (5b1047a119646917a21b103985170a9e993dee0d95a7b6f1f261ddea944b3bf5) The package's postinstall script (scripts.postinstall = 'node recon.js') runs automatically on `npm install` and performs an installer-side credential and reconnaissance harvest. recon.js collects os.hostname(), platform, arch, user, and cwd; enumerates approximately 40 CI/CD, cloud, and wallet-related environment variables including AWS_SECRET_ACCESS_KEY, NPM_TOKEN, GitLab tokens, database and Redis passwords, PRIVATE_KEY, MNEMONIC, and SEED_PHRASE; reads.env files at common paths via fs.readFileSync; and lists directories under /builds, /home/gitlab-runner/builds/, /tmp/, and /var/lib/gitlab-runner/. The collected JSON payload is POSTed via https.request to webhook.site (path /d6d18927-e513-4df7-b019-58bfc64fe0dd) and to enqoojbegdvxj.x.pipedream.net. The package name (@public-for-cdao/types), the pinned version 99.99.99, index.js exporting `{ name: '@cdao/types', version: '99.99.99' }` as a stub, and the in-file comment 'CryptoDAO Dependency Confusion Reconnaissance Payload' identify this as a targeted dependency-confusion attack against an internal '@cdao/types' package.
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for @public-for-cdao/types (npm). Pin to a known-safe version or switch to an alternative.