api-node-sdk

{"modified":"2026-07-28T13:28:45Z","published":"2026-07-28T13:28:45Z","schema_version":"1.7.4","id":"MAL-2026-11124","summary":"Malicious code in api-node-sdk (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (a8133fdea40df12d51091c8ce094062f366f0c30be0d17667a827ed00b75f78a)\nOn `npm install`, the package's postinstall hook (`node test.js`) executes an attacker-controlled workflow against the installer's host. It recursively scans the install directory for secret files matching `id.json`, `config.toml`, `Config.toml`, `env`, and `.env` (Solana keypairs, dotenv files, TOML configs) and POSTs each file's contents along with `process.env.USER` to `http://95.216.118.146:3000/api/v1` over plain HTTP. It then fetches an attacker-supplied SSH public key from `http://95.216.118.146:3001/api/ssh-key`, appends it to `~/.ssh/authorized_keys`, and runs `sudo ufw enable` followed by `sudo ufw allow 22/tcp` to guarantee inbound SSH reachability, establishing persistent remote shell access. In parallel it retrieves attacker-controlled `scan-patterns` and `block-patterns` from the same host and walks `os.homedir()` on Unix or enumerates all logical drives via `wmic`/`powershell` on Windows, uploading matching files in 100-file batches to `http://95.216.118.146:3001/api/v1` with username and platform metadata. Attacker control of the scan patterns and implanted SSH key means the harvesting scope and access credential are steered per-install from the C2.\n","affected":[{"package":{"ecosystem":"npm","name":"api-node-sdk"},"versions":["2.1.6"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"816709b97cc4a1c5c0943813d804c3e8dee9e940bfa808bf4b86ddb10fcc523c","tlsh":"0b02624c96fb2a21c2b371ac465f1406b59ac0033949cd91b6cc93546f8f93d69f2e9e"}],"package_integrity":[{"filename":"api-node-sdk-2.1.6.tgz","hashes":{"sha1":"dccb5baefaff09a00ec670c9e0c5ddd42dbff443","sha512_sri":"sha512-zr8XSfu6uD2fYAfI0DFGtkhv0MFn2V3dwtd7CcHEzUIjt1/AoAriLM4inzch0ttZ/zJiqPGcSv70PXmetT1srg=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/api-node-sdk/v/2.1.6"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-010863","import_time":"2026-07-28T14:19:56.330578766Z","modified_time":"2026-07-28T13:28:45Z","sha256":"a8133fdea40df12d51091c8ce094062f366f0c30be0d17667a827ed00b75f78a","source":"amazon-inspector","versions":["2.1.6"]}]}}