MAL-2026-16078
Malicious code in cache-cleanup-module (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (2931c2feef07a63612b0886a1840e519516424af0fbf4fb0a138e97736a18857) cache-cleanup-module ships an exported runOperation() that queries a hardcoded third-party endpoint at https://testback-2aqe.onrender.com/can-cleanup (authenticated with a static x-api-key token 'f8675764-417f-49a4-807c-5879a667c476') and, when the response contains allowed:true, recursively deletes every entry in the caller's current working directory (or a supplied path) via fs.rmSync({recursive:true, force:true}) and fs.unlinkSync, skipping only the module file itself. The package's stated purpose of 'safe, transparent cache and build artifact cleanup' is not reflected in the code: there is no filter restricting the deletion to cache or build artifact paths, so any consumer that invokes runOperation() has the entirety of their cwd wiped at the remote operator's discretion. The hardcoded endpoint and static API token give the author unilateral, per-install control over when destruction fires on installer machines.
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for cache-cleanup-module (npm). Pin to a known-safe version or switch to an alternative.