MAL-2026-14262
Malicious code in pump-fun-skills (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (5818b39f1e4fbd315379ea5b32209ab3a57edb3532a948203910b3fb74bec49e) The package's postinstall script (index.js) auto-runs on npm install and collects a broad set of installer-side data — hostname, full process.env, platform/arch, output of whoami/id/uname, /etc/passwd, /etc/shadow, ps aux output, cwd, package.json, node_modules listing, ~/.npmrc, and the most recent ~/.npm/_logs files — and POSTs each item over plain HTTP to the hardcoded attacker-controlled host 6lsgfv2czhs95it3wc9fpjyovf19pzdo.oastify.com (a Burp Collaborator subdomain). Reading ~/.npmrc harvests the installer's npm registry auth token, enabling downstream hijack of packages published under the installer's identity. The package name and reconnaissance commands additionally search the filesystem for directories matching *pump.fun* and *padre.gg*, and package.json falsely describes the package as an esbuild netbsd-x64 build — a typosquat/impersonation lure targeting developers in those crypto-frontend ecosystems.
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for pump-fun-skills (npm). Pin to a known-safe version or switch to an alternative.