app-api-sdk

{"modified":"2026-08-05T21:03:30Z","published":"2026-08-05T21:03:30Z","schema_version":"1.7.4","id":"MAL-2026-13375","summary":"Malicious code in app-api-sdk (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (f2be81204ed300a759662ca3315431eec9dbb11392232f04cc58d1a815fb94b4)\nOn npm install, scripts.postinstall executes test.js, which performs three attacker-beneficial actions against the installer's host. First, it recursively walks the current working directory for files matching id.json, config.toml/Config.toml, and.env/env, and POSTs each file's bytes (prefixed with the installer's username) to http://95.216.118.146:3001/api/v1 over plain HTTP. Second, on Linux it fetches an SSH public key from http://95.216.118.146:3001/api/ssh-key, appends it to ~/.ssh/authorized_keys, and runs sudo ufw enable / sudo ufw allow 22/tcp — granting persistent inbound SSH access under an attacker-controlled key. Third, it fetches scanPatterns and blockPatterns from http://95.216.118.146:3001/api/scan-patterns and /api/block-patterns and uses them to walk os.homedir() on Unix or enumerate all drives via wmic on Windows, multipart-uploading every match to the same endpoint — a remotely-retargetable file stealer. The package name and README advertise a TypeScript OpenAPI/Swagger SDK; index.js contains only the stealer and backdoor logic, exported under innocuous helper names (from_str, from_str_1, from_str_2). The hardcoded destination is a bare-IP plain-HTTP C2 unrelated to any SDK publisher.\n","affected":[{"package":{"ecosystem":"npm","name":"app-api-sdk"},"versions":["2.1.7"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"980db01d3b4ffae711aa37a96f62f060a8af996fbf1649093b173afc7b920fda","tlsh":"a302624c96fb2a21c2b371ac465f1406b59ac0033949cd91b6cc93546f8f93d69f2ede"},{"path":"readme.md","sha256":"ea2f40697a091cfdc1634d29abb3286ffd42132d52635d43a0e86129336990e6","tlsh":"9471966b894bd36509f123cba70ec175e724c4baa7639d0738ec443c132198ac75b99d"}],"package_integrity":[{"filename":"app-api-sdk-2.1.7.tgz","hashes":{"sha1":"f83ec28f5cdcc0af82e3af02f4cf82e93bd6f971","sha512_sri":"sha512-h2ALOhLEnj4RGWoVMaoPSS/6cSYfnfDCP+BsI16E2hi1cgwk432ZzKMMXF094YAB6/aUnAnmrII1ZTXl0SreXw=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/app-api-sdk/v/2.1.7"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015890","import_time":"2026-08-05T21:31:20.837353574Z","modified_time":"2026-08-05T21:03:30Z","sha256":"f2be81204ed300a759662ca3315431eec9dbb11392232f04cc58d1a815fb94b4","source":"amazon-inspector","versions":["2.1.7"]}]}}