weight2loss

{"modified":"2026-08-06T23:54:44Z","published":"2026-08-06T23:54:44Z","schema_version":"1.7.4","id":"MAL-2026-13485","summary":"Malicious code in weight2loss (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (e8b80ee1c23ef1ae185bbda67deab7b442f673434427f2c006acb4e7f388a52e)\nThe package ships setup.js, referenced by a postinstall hook in package.json, that on execution: (1) reads installer-side secrets from ~/.npmrc, ~/.ssh/*, ~/.gitconfig, ~/.aws/*, and a curated list of credential-shaped environment variables (GITHUB_TOKEN, AWS_SECRET_ACCESS_KEY, etc.); (2) exfiltrates the collected data, and a base64-encoded copy of process.env, to the hardcoded endpoint https://news.reimbursor.info via multiple POST requests, and additionally emails it through smtp.gmail.com using hardcoded attacker credentials (attacker.email@gmail.com); (3) pipes http://attacker.com/miner.sh and http://attacker.com/backdoor.sh into bash for immediate arbitrary code execution; (4) installs an hourly crontab entry that fetches and executes http://attacker.com/check via bash, establishing persistent remote command delivery; and (5) unlinks setup.js after execution to reduce forensic traces. The postinstall key is currently declared as a top-level package.json field rather than under scripts, so npm does not auto-invoke it on install in this exact version, but the full stealer/dropper/backdoor payload is present and functional if invoked (including by any require of setup.js or a corrected manifest). The declared purpose (fitness analytics) does not match any of the observed behavior.\n","affected":[{"package":{"ecosystem":"npm","name":"weight2loss"},"versions":["1.0.5"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"setup.js","sha256":"bd9f3ae03989400b04bdd4841e9a78b75fb71c3a67e5b3fe1a3c76cb1636ba1e","tlsh":"bae162a9087b11305867054b9b4f6034251ae20b3f69fce87f8d57058f4a72861e1bfe"},{"path":"package.json","sha256":"d3c4172220df041586f4342505b01a674e06ae83cbb2483d9170aa99b21f48d1","tlsh":"b8f02820c9216da356cb2a5b8c695146b6b54d0b050cfc1973cb411c8bdd66f24ff25d"}],"package_integrity":[{"filename":"weight2loss-1.0.5.tgz","hashes":{"sha1":"b322e762766e762e8a8b2fdfb994f2708a789897","sha512_sri":"sha512-GLLOnD3k54Eh1jVYOSGyFtGa0ZIAKUBR9pYqVaFtXa9eIZoItnmn8vOIwK7aaKyweummzsHhx101n6ir96rLEg=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/weight2loss/v/1.0.5"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-016845","import_time":"2026-08-07T00:59:21.141987096Z","modified_time":"2026-08-06T23:54:44Z","sha256":"e8b80ee1c23ef1ae185bbda67deab7b442f673434427f2c006acb4e7f388a52e","source":"amazon-inspector","versions":["1.0.5"]}]}}