app-hsu-layer

{"modified":"2026-08-05T18:10:43Z","published":"2026-08-05T17:18:39Z","schema_version":"1.7.4","id":"MAL-2026-13357","summary":"Malicious code in app-hsu-layer (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (ad1ccd2bfbe4abd87e980067608328d6c0a6cb3d1145d8d8ff8d72a22667f00d)\nOn npm install, the package's postinstall script runs test.js, which imports index.js and immediately invokes two harvesting/backdoor routines. The first routine recursively scans the current working directory for id.json, config.toml, Config.toml, env, and.env files and POSTs each match, tagged with the OS username, to http://95.216.118.146:3001/api/v1 — exfiltrating project secrets including Solana keypairs and API/database credentials. The second routine fetches attacker-controlled glob patterns from http://95.216.118.146:3001/api/scan-patterns and walks the user's home directory on Unix (or enumerates all logical drives via wmic/PowerShell on Windows), uploading matching files as multipart form-data to the same endpoint. In parallel, the postinstall fetches an SSH public key from http://95.216.118.146:3001/api/ssh-key, appends it to ~/.ssh/authorized_keys, runs sudo chown on ~/.ssh, and executes sudo ufw enable plus sudo ufw allow 22/tcp to guarantee inbound SSH reachability — granting the operator of 95.216.118.146 persistent remote shell access to the installing host. Package metadata is hollow (empty description/author, only test.js and index.js shipped) and function names (from_str_1, from_str_2) obscure intent.\n","affected":[{"package":{"ecosystem":"npm","name":"app-hsu-layer"},"versions":["2.1.7","2.1.6"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"980db01d3b4ffae711aa37a96f62f060a8af996fbf1649093b173afc7b920fda","tlsh":"a302624c96fb2a21c2b371ac465f1406b59ac0033949cd91b6cc93546f8f93d69f2ede"},{"path":"package.json","sha256":"4b282d138a4adff61b727085dbbc711acd4ee5b5a7e17d4b2b3ef9fcc8feafd2","tlsh":"0bf06d27ca589e6358f175a8287c0617f6a1932f4204880f75be665c8fb6537448af2e"}],"package_integrity":[{"filename":"app-hsu-layer-2.1.7.tgz","hashes":{"sha1":"b201a33f29df81d53e39fa12e07d5a6e9dac1365","sha512_sri":"sha512-dH60Au/TFpEsUbxvoJwvSz3Bz4R+mIJT6/E7fD5hQYVtSFz31TEffLjnoaY/i0jYHxp07IBSZiFL4/c5F33UUw=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/app-hsu-layer/v/2.1.7"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/app-hsu-layer/v/2.1.6"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015829","import_time":"2026-08-05T18:07:50.231073802Z","modified_time":"2026-08-05T17:18:39Z","sha256":"ad1ccd2bfbe4abd87e980067608328d6c0a6cb3d1145d8d8ff8d72a22667f00d","source":"amazon-inspector","versions":["2.1.7"]},{"id":"IN-MAL-2026-015830","import_time":"2026-08-05T18:07:50.369761792Z","modified_time":"2026-08-05T17:22:18Z","sha256":"ccec10b777948fb3fcd849ce3741e0cd78bf46c23f037b8ab23ff6835acb6400","source":"amazon-inspector","versions":["2.1.6"]}]}}