MAL-2026-10601
Malicious code in @public-for-cdao/common (npm)
상세
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (28545511de9101d471f9f9184bd6b86c16380ab3f4740f3772e794ce270b6aa5) Package declares a postinstall hook that runs recon.js on `npm install`. recon.js reads a broad list of secret-bearing environment variables (AWS_SECRET_ACCESS_KEY, NPM_TOKEN, SSH_PRIVATE_KEY, MNEMONIC, GitLab and CI_* tokens, DB/Redis passwords) and scans common.env file paths including /root/.env, /app/.env, and /home/gitlab-runner/.env for KEY/SECRET/TOKEN/PASS/PRIVATE/MNEMONIC matches. The harvested payload plus host identifiers is POSTed to two hardcoded non-first-party endpoints, webhook.site/d6d18927-e513-4df7-b019-58bfc64fe0dd and enqoojbegdvxj.x.pipedream.net, over HTTPS with certificate verification disabled (rejectUnauthorized:false). The package is published at version 99.99.99 under the public scope @public-for-cdao while index.js identifies itself as @cdao/common, and a source comment self-labels it a 'CryptoDAO Dependency Confusion Reconnaissance Payload' — the shape of a dependency-confusion attack against CI/CD builds that misroute an internal @cdao scope to the public registry.
이 버전이 영향받나요?
사용 중인 패키지 버전을 입력하면 즉시 평가합니다.
영향 패키지
No fixed version published yet for @public-for-cdao/common (npm). Pin to a known-safe version or switch to an alternative.