notafollower1

{"modified":"2026-08-14T14:30:02Z","published":"2026-08-14T14:06:58Z","schema_version":"1.7.4","id":"MAL-2026-14034","summary":"Malicious code in notafollower1 (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (7c74ec5369dac32115a9f5f257f512fa0a48d2e914b1f18c5178992b0a1604f9)\npackage.json declares a postinstall script that automatically runs on npm install and fetches AWS ECS container task metadata via the ECS_CONTAINER_METADATA_URI_V4 endpoint (task ARN, container names, image names), then POSTs the collected data to a hardcoded ngrok tunnel at https://mourner-slot-explicit.ngrok-free.dev using curl. The postinstall also inspects the container image name for substrings matching known security research operators (twbray, packagehound, wiz, oss-dynamic) and labels the payload accordingly, indicating deliberate sandbox and analyst fingerprinting. The destination is an anonymous ngrok tunnel unrelated to any legitimate publisher infrastructure, and the collected data reveals installer-side CI/build/container environment details to a third party.\n","affected":[{"package":{"ecosystem":"npm","name":"notafollower1"},"versions":["1.0.1","1.0.13","1.0.3","1.0.8","1.0.7","1.0.5","1.0.11","1.0.12","1.0.9","1.0.4","1.0.6","1.0.10","1.0.2","1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"package.json","sha256":"49e38ef34cb96fdf426132a1b6832d38fd9618e70cc21c4f9d845bd34a26f5bd","tlsh":"49f00e398d8d073338c88bac82109331edb12f435a09cb00b202038ed8a68618c15226"}],"package_integrity":[{"filename":"notafollower1-1.0.1.tgz","hashes":{"sha1":"a6bdbefc33981b32eb95225d25df287248389fca","sha512_sri":"sha512-TuuvugE71/QuqdWl23Cmm7oKh2OibMw1rp+ghRKFUR9WoVfyVMylKMMcUMlAyzn0SF+44ZQv59TggocFKc6mww=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/notafollower1/v/1.0.1"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/notafollower1/v/1.0.13"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/notafollower1/v/1.0.3"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/notafollower1/v/1.0.8"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/notafollower1/v/1.0.7"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/notafollower1/v/1.0.5"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/notafollower1/v/1.0.11"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/notafollower1/v/1.0.12"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/notafollower1/v/1.0.9"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/notafollower1/v/1.0.4"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/notafollower1/v/1.0.6"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/notafollower1/v/1.0.10"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/notafollower1/v/1.0.2"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/notafollower1/v/1.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-017765","import_time":"2026-08-14T14:28:07.262635469Z","modified_time":"2026-08-14T14:12:48Z","sha256":"091cafb83b896477a8f1fc1641f1790d59ba5b85f5bbcff87575414c833243ed","source":"amazon-inspector","versions":["1.0.1"]},{"id":"IN-MAL-2026-017743","import_time":"2026-08-14T14:28:05.001635625Z","modified_time":"2026-08-14T14:09:28Z","sha256":"74a5aad842ae4459d83b8c19a29f1b18810cee38b9028186cea3c5b14b54871e","source":"amazon-inspector","versions":["1.0.13"]},{"id":"IN-MAL-2026-017747","import_time":"2026-08-14T14:28:05.414682437Z","modified_time":"2026-08-14T14:10:08Z","sha256":"a4dfb61823381aa2045568f06b09cba0934b1c7e7835089f282f4656bd3a298f","source":"amazon-inspector","versions":["1.0.3"]},{"id":"IN-MAL-2026-017734","import_time":"2026-08-14T14:28:04.07446927Z","modified_time":"2026-08-14T14:08:04Z","sha256":"fe89c2f456042608dcf3de64627c2915927e1001278fdbaec028ebce70814885","source":"amazon-inspector","versions":["1.0.8"]},{"id":"IN-MAL-2026-017753","import_time":"2026-08-14T14:28:05.952215553Z","modified_time":"2026-08-14T14:11:06Z","sha256":"0a351210edff8fb93c661275745fa9ca97166f51c94aa8cbc798011705649c10","source":"amazon-inspector","versions":["1.0.7"]},{"id":"IN-MAL-2026-017751","import_time":"2026-08-14T14:28:05.795231671Z","modified_time":"2026-08-14T14:10:49Z","sha256":"185d90690759ac0bf5e675f796baadcc1ff6aa4bd2d80b7a09b388f08dd84fca","source":"amazon-inspector","versions":["1.0.5"]},{"id":"IN-MAL-2026-017737","import_time":"2026-08-14T14:28:04.336889624Z","modified_time":"2026-08-14T14:08:36Z","sha256":"384e83f216e580c0fd3f2d56a2ab20c97b46375d4dbd4128254af462f4e93c3e","source":"amazon-inspector","versions":["1.0.11"]},{"id":"IN-MAL-2026-017741","import_time":"2026-08-14T14:28:04.787103156Z","modified_time":"2026-08-14T14:09:09Z","sha256":"53fc5a6ac818157a2e95e5c291f80c7ffa530a233d4646581818cdd9aa5b85c9","source":"amazon-inspector","versions":["1.0.12"]},{"id":"IN-MAL-2026-017732","import_time":"2026-08-14T14:28:03.80128191Z","modified_time":"2026-08-14T14:07:48Z","sha256":"7c74ec5369dac32115a9f5f257f512fa0a48d2e914b1f18c5178992b0a1604f9","source":"amazon-inspector","versions":["1.0.9"]},{"id":"IN-MAL-2026-017749","import_time":"2026-08-14T14:28:05.598166623Z","modified_time":"2026-08-14T14:10:23Z","sha256":"1cc23d75386087eeceab1871b2c8b3aa0381a45972e910f457334ca8df5d0bf7","source":"amazon-inspector","versions":["1.0.4"]},{"id":"IN-MAL-2026-017726","import_time":"2026-08-14T14:28:03.293091442Z","modified_time":"2026-08-14T14:06:58Z","sha256":"1e9f59224211c5b834225e61c33420528d064622314d824f2af9b423e71aa378","source":"amazon-inspector","versions":["1.0.6"]},{"id":"IN-MAL-2026-017736","import_time":"2026-08-14T14:28:04.260805257Z","modified_time":"2026-08-14T14:08:26Z","sha256":"5241d5952af63a69847a219ddff9f457d7e21e03714f4a8db371df3e493ba3ff","source":"amazon-inspector","versions":["1.0.10"]},{"id":"IN-MAL-2026-017745","import_time":"2026-08-14T14:28:05.195077252Z","modified_time":"2026-08-14T14:09:45Z","sha256":"589c0efe29f345435d1eea107e7a4448cc465510802f9005174c0bb3ac431f21","source":"amazon-inspector","versions":["1.0.2"]},{"id":"IN-MAL-2026-017738","import_time":"2026-08-14T14:28:04.426461631Z","modified_time":"2026-08-14T14:08:45Z","sha256":"592bcb564cad8b98bd5cbfb2a8cde839814832f53603068a3067eb61f803d79d","source":"amazon-inspector","versions":["1.0.0"]}]}}