MAL-2026-10945

The zer0onetencent2 package was published to the npm registry by user 't2423048543' (maintainer email t2423048543@gmail.com). It is described as 'A simple date formatting utility' but ships no such functionality; index.js only exports a hello() stub returning the package name, indicating a package created to deliver an install-time payload.

The package.json declares a postinstall hook ("node postinstall.js") that runs automatically at npm install time. The bundled postinstall.js embeds a shell command chain that performs cloud-metadata SSRF and credential/environment harvesting: it queries a public IP echo service (http://cip.cc), probes a Meituan/Sankuai internal SSRF test endpoint (https://mtsrc-test.sankuai.com/ssrf), requests AWS EC2 instance metadata credentials for the IAM role 'sandyclaw-canary-worker-role' (http://169.254.169.254/latest/meta-data/iam/security-credentials/sandyclaw-canary-worker-role), and reads Tencent Cloud metadata (http://metadata.tencentyun.com/latest/meta-data/ and http://169.254.0.23/latest/meta-data/). It then reads the installing process's environment via /proc/self/environ and exfiltrates the concatenated output, together with a directory listing of /data/, by HTTP POST to the attacker-controlled Burp Collaborator endpoint http://kuir5t6qdp277zbqsg4bo7x4bvhm5dt2.oastify.com (paths /metadata and /data).

As shipped, the malicious command chain is stored inside postinstall.js as a JSON document (a copy of a package manifest) rather than as executable JavaScript, so the 'node postinstall.js' hook raises a syntax error and the embedded payload does not execute as-published; the intent and payload are nonetheless unambiguously malicious. A sibling package (zer0onetencent) by the same maintainer carries an identical payload differing only in the Collaborator subdomain.

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (8d60f8b198581db53ab0cd38d6cb71b4e0ee79d04e26b7c8cca65ce5ac84a68b) The package's postinstall.js lifecycle script runs automatically on npm install and performs credential harvesting against the installer's host or CI environment. It curls the AWS instance metadata service at 169.254.169.254 to retrieve IAM role credentials (writing them to /tmp/aws.txt), queries the Tencent Cloud metadata endpoint at metadata.tencentyun.com, probes an internal Meituan SSRF target, and reads /proc/self/environ to capture all process environment variables. The aggregated contents are POSTed with curl -X POST -d to http://kuir5t6qdp277zbqsg4bo7x4bvhm5dt2.oastify.com/metadata, a Burp Collaborator (oastify.com) attacker-controlled sink. A second POST exfiltrates a directory listing of /data/. Installing this package on a machine with cloud metadata reachability or CI secrets in the environment leaks IAM temporary credentials and environment secrets to a third-party attacker collector.