chart-data-utils

{"schema_version":"1.7.4","id":"MAL-2026-12350","published":"2026-08-05T12:31:46Z","modified":"2026-09-24T09:23:26.354250317Z","summary":"Malicious code in chart-data-utils (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (3980b39b1ba77c4c8df0b8e08016a299640a60b6255c1ea8be1883343ec750e9)\nchart-data-utils@1.0.0 advertises itself as a chart data/color helper library (index.js contains only trivial color utilities), but ships a postinstall.js that runs at npm install time and performs credential harvesting and host reconnaissance. The postinstall shells out via child_process.exec to: (1) collect hostname, whoami/id output, Docker/cgroup indicators, sudo -ln, ps aux, ip addr/route; (2) enumerate process environment variables and grep-filter for KEY|TOKEN|SECRET|CREDENTIAL|NPM_TOKEN|AWS_|AZURE|GCP|GITHUB_TOKEN plus GitHub Actions identity fields (GITHUB_TOKEN, GITHUB_REPOSITORY, GITHUB_ACTOR, RUN_ID); (3) probe cloud instance-metadata endpoints at 169.254.169.254 (AWS), 100.100.100.200 (Aliyun), metadata.google.internal (GCP), metadata.tencentyun.com (Tencent), and an internal host tst.woa.com; (4) base64-encode the collected data and POST/GET it over plain HTTP to the hardcoded Burp Collaborator subdomain pzs5w7ntzhsnepwk564lyfdci3oucl0a.oastify.com. The package name/description are a cover story for a CI credential harvester; Chinese-language comments (\"分片回传版\") in the postinstall reference tst.woa.com.\n","affected":[{"package":{"name":"chart-data-utils","ecosystem":"npm"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"postinstall.js","sha256":"b0fd56908ccfeea473ff249ab63aa2d4eb43d34dc160c2f9da94836587a5cb84","tlsh":"cc71f2c4da6cb837333ad550e65a48075e87e8af4eb8ff8158362e20010cb463677a77"},{"path":"package.json","sha256":"77a52dfc0e1a660cb457ebfbc70984acce594f37af10c0519c366c6d5f16ba15","tlsh":"13e07d30e91096332dc597a92d97c2013b315d0712083c4817972518439f2f1e0ffb1d"}],"package_integrity":[{"filename":"chart-data-utils-1.0.0.tgz","hashes":{"sha1":"701a44eee22ef2e3819a1d6df5d544fbc45d2473","sha512_sri":"sha512-crHgDGf2OG9zQ0IHRk362t23rdcRxrJnyJigiGSGjtmGwEuz5qqAsKPjY+1y6AJAIWQKKpyWTXdKK4zmG5O7dg=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/chart-data-utils/v/1.0.0"}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-014692","import_time":"2026-08-05T13:08:37.963621839Z","modified_time":"2026-08-05T12:31:46Z","sha256":"3980b39b1ba77c4c8df0b8e08016a299640a60b6255c1ea8be1883343ec750e9","source":"amazon-inspector","versions":["1.0.0"]},{"id":"RLMA-2026-10708","import_time":"2026-09-24T09:21:33.313945651Z","modified_time":"2026-09-22T17:20:33Z","sha256":"b001e6b1c64d22d2d8296063437467584bf581b0d573accc93b09833716dac25","source":"reversing-labs","versions":["1.0.0"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"ReversingLabs","contact":["https://www.reversinglabs.com"],"type":"FINDER"}]}