nagix-nodejs

{"modified":"2026-08-04T21:11:37Z","published":"2026-08-04T21:11:37Z","schema_version":"1.7.4","id":"MAL-2026-11526","summary":"Malicious code in nagix-nodejs (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (b8ce2f0b04a8b6a69d540678c440c14c0c4b9b5a6cf6a957e020aceff239c279)\npackage.json declares \"postinstall\": \"node test.js\", which auto-executes on npm install and invokes two exported routines in index.js. The first recursively walks process.cwd() for files named id.json, config.toml, Config.toml, env, and.env (Solana keypairs, Rust/CLI config, environment secrets) and POSTs each match, prefixed with process.env.USER, to http://95.216.118.146:3000/api/v1 over plain HTTP. The second fetches attacker-controlled scan and block patterns from http://95.216.118.146:3001/api/scan-patterns, then scans os.homedir() on Unix or enumerates all drive letters via wmic/PowerShell on Windows, batch-uploading matching files with username/platform metadata to http://95.216.118.146:3001/api/v1. On Linux, addSshKeyToUser fetches an SSH public key from http://95.216.118.146:3001/api/ssh-key, appends it to ~/.ssh/authorized_keys, chowns the.ssh directory via sudo, and runs sudo ufw enable and sudo ufw allow 22/tcp to guarantee inbound SSH reachability. The README advertises an unrelated TypeScript OpenAPI/Express tool (ts-api) and the harmful functions are labeled from_str_1/from_str_2 to mimic benign Rust-style helpers.\n","affected":[{"package":{"ecosystem":"npm","name":"nagix-nodejs"},"versions":["2.1.6"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"816709b97cc4a1c5c0943813d804c3e8dee9e940bfa808bf4b86ddb10fcc523c","tlsh":"0b02624c96fb2a21c2b371ac465f1406b59ac0033949cd91b6cc93546f8f93d69f2e9e"},{"path":"package.json","sha256":"e26ee27fd15e22a031a2ba1f66807e0b9ebb3e2d1d69736d3174b21d938cbea0","tlsh":"ebf0a927ca588e6328f125a828780616f691932f0100880f35bd664c4fb61230085a1e"},{"path":"readme.md","sha256":"ea2f40697a091cfdc1634d29abb3286ffd42132d52635d43a0e86129336990e6","tlsh":"9471966b894bd36509f123cba70ec175e724c4baa7639d0738ec443c132198ac75b99d"}],"package_integrity":[{"filename":"nagix-nodejs-2.1.6.tgz","hashes":{"sha1":"3eac66e712b0ba447f71a301499d24816cb488d3","sha512_sri":"sha512-d55qMmwcJW9R3tY/YJ3VUiU71ffSxhThFzFcNA/fqrhZF2oPFBoou6j7zcwn2od6C72y9JmbGPSmL6P4auhd0w=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/nagix-nodejs/v/2.1.6"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-010976","import_time":"2026-08-04T21:33:11.990851417Z","modified_time":"2026-08-04T21:11:37Z","sha256":"b8ce2f0b04a8b6a69d540678c440c14c0c4b9b5a6cf6a957e020aceff239c279","source":"amazon-inspector","versions":["2.1.6"]}]}}