notafollower1226

{"modified":"2026-08-14T14:30:02Z","published":"2026-08-14T14:07:21Z","schema_version":"1.7.4","id":"MAL-2026-14036","summary":"Malicious code in notafollower1226 (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (fdc72e98071e37ff58c3bb327f995c9c586b81a22180a8004b6564026cbc629f)\nThe package.json postinstall script auto-executes on npm install. It queries the ECS container metadata endpoint (ECS_CONTAINER_METADATA_URI_V4/task) to collect the Task ARN, container image list, and log group/stream configuration, then enumerates process.env for keys matching /owner|team|user|created|author|maintainer|contact/i, and pipes the resulting report via `curl -X POST --data-binary @-` to the hardcoded anonymous ngrok tunnel https://mourner-slot-explicit.ngrok-free.dev. The destination is not associated with any declared publisher and ngrok-free.dev subdomains are ephemeral anonymous tunnels typical of supply-chain reconnaissance against CI/build infrastructure. The package ships no other functionality consistent with a legitimate declared purpose; its only install-time effect is the exfiltration beacon.\n","affected":[{"package":{"ecosystem":"npm","name":"notafollower1226"},"versions":["1.0.3","1.0.5","1.0.2","1.0.1","1.0.0","1.0.4"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"package.json","sha256":"6950161f4fd924e6e2fa1868e6b2f5fcce82c7b2094252b9d791ed8b5b89e7e0","tlsh":"94016564ce4916b668ce8bcc59479253e562741bb910cdc8e6b42464cac3e87bc23319"}],"package_integrity":[{"filename":"notafollower1226-1.0.3.tgz","hashes":{"sha1":"3498d083afee410b3019692088040de57090d3de","sha512_sri":"sha512-Un/ZzPbSgXYpiUf+f6nqfHiMEdwsyUpQpnR1HEmleASTVhGju8hQVK77SQ94lLHwxRep/8+Qdtgq2zMaKPR7Hg=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/notafollower1226/v/1.0.3"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/notafollower1226/v/1.0.5"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/notafollower1226/v/1.0.2"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/notafollower1226/v/1.0.1"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/notafollower1226/v/1.0.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/notafollower1226/v/1.0.4"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-017763","import_time":"2026-08-14T14:28:07.081685824Z","modified_time":"2026-08-14T14:12:33Z","sha256":"3bcf9577fe9f2f92d37e3ca5b59f9e44829debf5404254c759e2e98c3586a2a6","source":"amazon-inspector","versions":["1.0.3"]},{"id":"IN-MAL-2026-017729","import_time":"2026-08-14T14:28:03.55331463Z","modified_time":"2026-08-14T14:07:21Z","sha256":"5952c329f4f236534541bd9473d97f380c4b6a3f6ae89c4024cb59e9b467ae58","source":"amazon-inspector","versions":["1.0.5"]},{"id":"IN-MAL-2026-017764","import_time":"2026-08-14T14:28:07.187105602Z","modified_time":"2026-08-14T14:12:41Z","sha256":"664d1be72acf562df144f741b727bc66b65c1d740fee1c7c77f22e1af0abd679","source":"amazon-inspector","versions":["1.0.2"]},{"id":"IN-MAL-2026-017742","import_time":"2026-08-14T14:28:04.881974478Z","modified_time":"2026-08-14T14:09:20Z","sha256":"6eee9700fa8aef87c54e74f243f093f510e29eddfdb5fdbfa369d31a435f9668","source":"amazon-inspector","versions":["1.0.1"]},{"id":"IN-MAL-2026-017778","import_time":"2026-08-14T14:28:08.415609892Z","modified_time":"2026-08-14T14:22:36Z","sha256":"8b1450e0f0ed1fb1548ee13a13bd220e327cbd07f60fe1dd99e43e09f7dd2ff7","source":"amazon-inspector","versions":["1.0.0"]},{"id":"IN-MAL-2026-017744","import_time":"2026-08-14T14:28:05.111256076Z","modified_time":"2026-08-14T14:09:38Z","sha256":"fdc72e98071e37ff58c3bb327f995c9c586b81a22180a8004b6564026cbc629f","source":"amazon-inspector","versions":["1.0.4"]}]}}