MAL-2026-16464
Malicious code in hachutis (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (455f1d04545c9ed17722705fe61415d7e536e2800c2a3c588ab69985004c73b9) The tarball ships three undeclared prebuilt executables under bin/ (bin/cli, bin/cli-linux-amd64, and an 81 MB Bun-compiled bin/cli-http-linux) that are not exposed via package.json.bin. The manifest's only bin entry hatcher-env points to bin/cli.js, which is absent from the tarball, and the declared main src/index.js is an unrelated dotenv-style parser hardcoded to /home/hatch/test.dat with no reference to the shipped binaries. The bundled JS region of bin/cli-http-linux embeds the anonymous Cloudflare Tunnel host already-query-bacteria-agreed.trycloudflare.com adjacent to HTTP POST verbs, and the README instructs the installer to execute one of the./bin/ binaries at least once to 'activate the package in our systems.' Running the binary opens a channel from the installer's host to an attacker-controlled trycloudflare.com tunnel; the readable JS surface is a decoy for opaque native payloads whose actual behavior is not documented.
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for hachutis (npm). Pin to a known-safe version or switch to an alternative.