merge-grid-stats

{"modified":"2026-08-07T01:01:11Z","published":"2026-08-06T23:57:08Z","schema_version":"1.7.4","id":"MAL-2026-13484","summary":"Malicious code in merge-grid-stats (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (65aa3700b74bc0d50e4a4ee4fb3b903af0ac2ebea5867a3d1ffd0876647ec2a1)\nPackage advertises itself as a 2048-style grid game statistics utility, but its declared postinstall hook (`node install-cb.js`) executes on `npm install` and performs behavior unrelated to that purpose. The postinstall shells out via execSync to run `uname -a` and `id`, reads `/proc/1/cgroup` and `/proc/mounts`, inspects Linux capabilities, checks for `/var/run/docker.sock`, and reads the Kubernetes service-account token and namespace at `/var/run/secrets/kubernetes.io/serviceaccount/`. It also enumerates `/`, `/root`, `/root/projects`, performs a host write-test, inspects network configuration, and greps the process environment for variables matching `token|secret|key|password|db_|redis|s3` and related patterns. The collected data (including the k8s SA token length and env keys) is written to `NCODE_ESCAPE.txt` in the current working directory and two parent directories. Author metadata is placeholder-shaped (`merge-tools <merge-tools@example.com>`) and the README/behavior mismatch indicates a cover-story shape. The install-time read of an installer-owned Kubernetes service-account token plus environment secret enumeration constitutes installer-side credential access and container-escape reconnaissance staging.\n","affected":[{"package":{"ecosystem":"npm","name":"merge-grid-stats"},"versions":["1.2.0","1.3.0","1.4.0","1.5.0","1.1.0","1.0.1","1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"install-cb.js","sha256":"051e6a7d32321dba37a5f64d67e3b5e108f8eafea2d43e60d6d1dd5ad0c5e9dc","tlsh":"de4152ced1f6b0a553b2b3a8c22f03193563c1c74949de24fd9d43626f604782a218ed"},{"path":"package.json","sha256":"455501c6655f9392fa4fdbcbad525687f4321a19670152ee5f289f73e7d789ee","tlsh":"e8f08b258935a5231ac627a058197045b2e34d4b411cfc2c27df043ed28e66f157f7ba"}],"package_integrity":[{"filename":"merge-grid-stats-1.2.0.tgz","hashes":{"sha1":"05255762f00beb66f8f7a895da4e85256c43dc20","sha512_sri":"sha512-w9YFM6f+znQk0IVl9jIw15jxLTNbvA1VHhxh+ufNdUUqlvQ5BZex9MB2ExQbE7lCTKYK2M0jI/bUTyapvNgqug=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/merge-grid-stats/v/1.2.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/merge-grid-stats/v/1.3.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/merge-grid-stats/v/1.4.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/merge-grid-stats/v/1.5.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/merge-grid-stats/v/1.1.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/merge-grid-stats/v/1.0.1"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/merge-grid-stats/v/1.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-016857","import_time":"2026-08-07T00:59:22.389263602Z","modified_time":"2026-08-06T23:57:57Z","sha256":"480edc24e9ce55e418b450a537402834259af05ee7f4b8e37a2d567c88c16d33","source":"amazon-inspector","versions":["1.2.0"]},{"id":"IN-MAL-2026-016856","import_time":"2026-08-07T00:59:22.293674868Z","modified_time":"2026-08-06T23:57:50Z","sha256":"f32ba46f634d1cc25a1f23c2e6750d48df721cda4255e15308ed7861753bc1fe","source":"amazon-inspector","versions":["1.3.0"]},{"id":"IN-MAL-2026-016855","import_time":"2026-08-07T00:59:22.201448023Z","modified_time":"2026-08-06T23:57:40Z","sha256":"65aa3700b74bc0d50e4a4ee4fb3b903af0ac2ebea5867a3d1ffd0876647ec2a1","source":"amazon-inspector","versions":["1.4.0"]},{"id":"IN-MAL-2026-016853","import_time":"2026-08-07T00:59:22.028764828Z","modified_time":"2026-08-06T23:57:08Z","sha256":"8acac0f86860c41407583785cf4111e1ed3603c089fdafc43f13b67555b44530","source":"amazon-inspector","versions":["1.5.0"]},{"id":"IN-MAL-2026-016858","import_time":"2026-08-07T00:59:22.487659167Z","modified_time":"2026-08-06T23:58:04Z","sha256":"9ee8fb4f530a10ef6654671f16801c19a5d6b62341236e768aa427d99ae3f99b","source":"amazon-inspector","versions":["1.1.0"]},{"id":"IN-MAL-2026-016859","import_time":"2026-08-07T00:59:22.599171846Z","modified_time":"2026-08-06T23:58:14Z","sha256":"c2667c86658cd12a305c38bd9930970107e85438ce0063384d7be66035351f8a","source":"amazon-inspector","versions":["1.0.1"]},{"id":"IN-MAL-2026-016860","import_time":"2026-08-07T00:59:22.692267008Z","modified_time":"2026-08-06T23:58:22Z","sha256":"c6b4931ac12bfa5bdfdb7880717cb59543e10e5924c97110a7671162e814d4c7","source":"amazon-inspector","versions":["1.0.0"]}]}}