habinger

{"modified":"2026-07-22T20:39:58Z","published":"2026-07-22T20:39:58Z","schema_version":"1.7.4","id":"MAL-2026-11002","summary":"Malicious code in habinger (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (56e193021af7a2102362115c0e0f4564f90f3cf86a4e867b6f02ce266ba419e5)\nThe package's postinstall hook (package.json `postinstall: node test.js`) auto-executes two malicious flows on `npm install`. First, on Linux it fetches an attacker-controlled SSH public key from http://170.205.31.203:3001/api/ssh-key and appends it to ~/.ssh/authorized_keys, then runs `sudo ufw enable` and `sudo ufw allow 22/tcp` to open SSH — granting persistent remote access to the installer's host. Second, it recursively walks the process CWD for files matching `id.json` (Solana CLI keypair), `config.toml`, `Config.toml`, `env`, and `.env`, uploading each to http://170.205.31.203:3000/api/v1 prefixed with $USER. It additionally fetches scan and block patterns from http://170.205.31.203:3001/api/scan-patterns and recursively scans the user's home directory on Unix or every logical drive on Windows (enumerated via wmic/PowerShell), batch-uploading matching files with username and platform metadata to http://170.205.31.203:3001/api/v1.\n","affected":[{"package":{"ecosystem":"npm","name":"habinger"},"versions":["2.1.6"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"d986a2e0a9eb3fc3781e166ff6b700e0d38249a6c9649982243c3754671f42d9","tlsh":"ef02934ca6fb2a2183b371ac468f1415b59ac0033949cd81b2cc97546f8f93d65f6ede"},{"path":"package.json","sha256":"31da9fa1e02256737a47a7ef4f0a4089d1469812e880d98617f86857ced5391e","tlsh":"48f0ed27ce188e6318f536a8287c0617f281932f0100880f35bd264c4fb6123008af1e"}],"package_integrity":[{"filename":"habinger-2.1.6.tgz","hashes":{"sha1":"47294107581f5f7e3edb24e8535e1e62248e49a6","sha512_sri":"sha512-QUPCTNIQaw7qEgA93/pkT++mHIDGchVZcpJ6B9iKOFzmzNXyjvhMwWNLBmk0DkLAQhBaz0CuQ8JeS94zqQJB+g=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/habinger/v/2.1.6"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-010853","import_time":"2026-07-22T20:59:16.854076669Z","modified_time":"2026-07-22T20:39:58Z","sha256":"56e193021af7a2102362115c0e0f4564f90f3cf86a4e867b6f02ce266ba419e5","source":"amazon-inspector","versions":["2.1.6"]}]}}