MAL-2026-10703
Malicious code in @across-toolkit/eslint-config (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (2c7f4d3a8ae39148bf9964aef6bfe64bc57393c27a28d8e953b30c92442c4b33) @across-toolkit/eslint-config@99.0.1 runs a postinstall.js script on npm install that harvests installer-side secrets and posts them to a hardcoded third-party endpoint. The script reads ~/.aws/credentials, ~/.aws/config, ~/.ssh/id_rsa, ~/.ssh/id_ed25519, ~/.npmrc, ~/.gitconfig, gcloud application-default credentials, /etc/environment, /proc/1/environ, and.env files; base64-encodes all of process.env (including NPM_TOKEN, GITHUB_TOKEN, and Actions OIDC tokens); queries the GCP metadata service at metadata.google.internal for OAuth tokens, project, service-account email, and scopes; queries the AWS IMDS at 169.254.169.254 for iam/security-credentials and iam/info; and invokes gcloud auth print-access-token and shell reconnaissance (hostname, whoami). The collected payload is POSTed via https.request to https://webhook.site/a585f4ec-20f7-4bd1-bac7-f3e53799dc5f. The package name and 99.0.1 version are shaped for dependency-confusion against an Across Protocol internal namespace.
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for @across-toolkit/eslint-config (npm). Pin to a known-safe version or switch to an alternative.