MAL-2026-15572
Malicious code in grafeno-payments (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (7af58da84956e51749cbb96923f12264cfdee76456b5010b526599b7da2c0caa) On `npm install`, package.json's preinstall hook (`node preinstall.js || true`) auto-runs a script that (1) enumerates process.env for keys matching AWS|TOKEN|KEY|SECRET|PASS|API, concatenates them with the machine's hostname and username, base64-encodes the blob, and exfiltrates it via `curl` GET to http://216.126.236.46/r.php over plain HTTP; and (2) on non-Windows hosts invokes `bash -i` with a /dev/tcp redirection to 216.126.236.46:4444, giving the remote endpoint an interactive shell on the installer's machine. The `|| true` suffix suppresses errors so `npm install` reports success while the payload runs. The package's stated payments purpose is a cover story; the shipped preinstall behavior is credential theft plus full-host remote code execution against the installer.
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for grafeno-payments (npm). Pin to a known-safe version or switch to an alternative.