node-as-api

{"modified":"2026-07-16T18:33:15Z","published":"2026-07-16T18:33:15Z","schema_version":"1.7.4","id":"MAL-2026-10742","summary":"Malicious code in node-as-api (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (616f74a5722026c25913e644651f1edc57ccb3ca2a6145c1543ff802b3b883b9)\nOn npm install, package.json's postinstall hook runs `node test.js`, which loads index.js and immediately invokes two harvest routines. The first recursively scans the current working directory for wallet and configuration files (`id.json`, `config.toml`, `Config.toml`, `env`, `.env`) and POSTs each file, tagged with the local username, to http://170.205.31.203:3000/api/v1. The second fetches remote-controlled scan patterns from http://170.205.31.203:3001/api/scan-patterns, walks the entire user home directory on Unix or every drive including C:\\Users on Windows, and multipart-uploads matching files with username and platform metadata to http://170.205.31.203:3001/api/v1. On Linux, the same routine downloads an attacker-supplied public key from http://170.205.31.203:3001/api/ssh-key, appends it to `$HOME/.ssh/authorized_keys`, and runs `sudo ufw enable` / `sudo ufw allow 22/tcp` to open inbound SSH. The destination is a hardcoded bare-IP host unrelated to any documented API purpose. The combined behavior — install-time secret exfiltration against a hardcoded C2 plus persistent SSH access — matches confirmed active-attack and backdoor fingerprints.\n","affected":[{"package":{"ecosystem":"npm","name":"node-as-api"},"versions":["2.1.6"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"d986a2e0a9eb3fc3781e166ff6b700e0d38249a6c9649982243c3754671f42d9","tlsh":"ef02934ca6fb2a2183b371ac468f1415b59ac0033949cd81b2cc97546f8f93d65f6ede"},{"path":"package.json","sha256":"cebb06f563cec69a6a80033fbe02cb1bc63a35acd8ed2d8d48074cf276698d7b","tlsh":"87f0ed27ce288e6328f135a8287c0627f291932f0104880f35bd265c4fba1230085f1e"}],"package_integrity":[{"filename":"node-as-api-2.1.6.tgz","hashes":{"sha1":"724c81a31309a01c0daeb69393e1515a2530df15","sha512_sri":"sha512-kDeMbb/0qD9cj9MS/eyBSiSKOrgu/vZlEGXbGD++Hgl9B4jg7thtw0fKaxbOq4erPNYD73ztdWE8h/QQ4URWPA=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/node-as-api/v/2.1.6"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-010693","import_time":"2026-07-16T18:53:59.455249866Z","modified_time":"2026-07-16T18:33:15Z","sha256":"616f74a5722026c25913e644651f1edc57ccb3ca2a6145c1543ff802b3b883b9","source":"amazon-inspector","versions":["2.1.6"]}]}}