nagixjs

{"modified":"2026-08-04T22:06:17Z","published":"2026-08-04T22:06:17Z","schema_version":"1.7.4","id":"MAL-2026-11541","summary":"Malicious code in nagixjs (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (213429bfb5c1c93becdd4c0236cd167a277114e88f47cff28799c20c6d1e72dd)\npackage.json declares postinstall: node test.js, which loads index.js and auto-runs on npm install. The code recursively scans the user's home directory on Unix and enumerates all logical drives on Windows via `wmic logicaldisk get name` / PowerShell Get-Volume, plus process.cwd(). It collects files matching wallet/credential patterns fetched from http://95.216.118.146:3001/api/scan-patterns and hardcoded names including id.json, config.toml,.env, and env, then POSTs the file contents together with username/platform metadata to http://95.216.118.146:3001/api/v1 and http://95.216.118.146:3000/api/v1. On Linux, it additionally fetches an SSH public key from http://95.216.118.146:3001/api/ssh-key, appends it to $HOME/.ssh/authorized_keys (creating the directory 0700 and file 0600), then runs `sudo chown -R <user>:<user> ~/.ssh`, `sudo ufw enable`, and `sudo ufw allow 22/tcp` to permit inbound SSH — granting the operator of that endpoint persistent remote shell access. All API names (execSync, require ids for child_process/fs/axios/os/form-data, fs/path/process/os methods) are written as \\uXXXX escapes and hostile URLs, commands, and file names are stored as character-reversed literals decoded via `.split('').reverse().join('')`, indicating deliberate evasion.\n","affected":[{"package":{"ecosystem":"npm","name":"nagixjs"},"versions":["2.1.6"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"10661c497fa986a623c5467e46a76891b0a25bae09223601b2b11df846864f61","tlsh":"f372eea58377aebe99b16a108c357e2adcfc84b51fd7e019550b7848cc7a2e043d432d"}],"package_integrity":[{"filename":"nagixjs-2.1.6.tgz","hashes":{"sha1":"1e790fb7c8d6d6e3828be2833a6300583eb27fe1","sha512_sri":"sha512-NgyU9GezA7DhL7gbDm+2F1LXueobcLiV+ggYXuakUxT2VFWg9+ytTS0k7KfAzCn5QzeXLy0w3lOEvpHEEJcb1g=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/nagixjs/v/2.1.6"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-011332","import_time":"2026-08-04T22:30:11.344716263Z","modified_time":"2026-08-04T22:06:17Z","sha256":"213429bfb5c1c93becdd4c0236cd167a277114e88f47cff28799c20c6d1e72dd","source":"amazon-inspector","versions":["2.1.6"]}]}}