upload-to-gcp

{"modified":"2026-08-15T18:07:45Z","published":"2026-08-15T18:07:45Z","schema_version":"1.7.4","id":"MAL-2026-14067","summary":"Malicious code in upload-to-gcp (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (4094f90a9780964738c1b9aea702c5554c802fba03f1a7e28c0703531dd04590)\nupload-to-gcp@3.2.1 runs a postinstall lifecycle script on npm install that collects host identifiers (os.hostname(), process.platform, process.arch, Node version, package name, npm lifecycle event) and POSTs them to a hardcoded remote endpoint at https://z5owtt3g.instances.poc.jchunt.top/upload-to-gcp. The destination is a random-looking subdomain not associated with Google Cloud Platform or any documented first-party service, and the transmission occurs automatically at install time with no opt-in and no disclosure. The package name suggests a GCP upload utility, which is inconsistent with the observed beaconing behavior to an unrelated host.\n","affected":[{"package":{"ecosystem":"npm","name":"upload-to-gcp"},"versions":["3.2.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"postinstall.js","sha256":"6c942eeec0ceda9021dcfacc519e832a5ad856404a6d789c399b82d7157aa8ce","tlsh":"f4019ed0d1b99b311bf45780a191a90782bbd163770a617a6bd805753f8d5f9003719d"}],"package_integrity":[{"filename":"upload-to-gcp-3.2.1.tgz","hashes":{"sha1":"c9ef295d9b5407590e224223e4edf09736286cf6","sha512_sri":"sha512-NBwHVfjtsasfO0RDJaFnwuVjs8i4V0YrYeH6zYjo/T8SRuc9zKprxuYhmJhdM3BI9D1dIPMsqgXI4wwCTAjnCw=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/upload-to-gcp/v/3.2.1"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-017973","import_time":"2026-08-15T18:08:48.526886933Z","modified_time":"2026-08-15T18:07:45Z","sha256":"4094f90a9780964738c1b9aea702c5554c802fba03f1a7e28c0703531dd04590","source":"amazon-inspector","versions":["3.2.1"]}]}}