carbon-monorepo

{"modified":"2026-08-19T03:41:18Z","published":"2026-08-19T03:41:18Z","schema_version":"1.7.4","id":"MAL-2026-14229","summary":"Malicious code in carbon-monorepo (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (9c617e93833344e13d376182fb00c13994a4d2e7f3f8220998e541d77a8e8713)\nThe package's package.json declares a postinstall hook that runs index.js on npm install. index.js collects host reconnaissance and installer secrets — os.hostname(), full process.env, platform/arch, cwd, package.json, node_modules listing, and the output of shell commands whoami/uname/id/cat /etc/passwd/cat /etc/shadow — and reads ~/.npmrc (which typically contains npm auth tokens) and recent ~/.npm/_logs. The collected data is POSTed over plain HTTP via http.request to the hardcoded host ywy8qnd4a931ga4v74k70b9g67c00qof.oastify.com, a Burp Collaborator (OAST) subdomain. Package metadata masquerades as an esbuild netbsd-x64 build (`\"description\": \"netbsd-x64 build for esbuild\"`) but the tarball ships only the recon/exfil script, no build artifacts or library code — the sole install-time effect is running the exfiltration payload.\n","affected":[{"package":{"ecosystem":"npm","name":"carbon-monorepo"},"versions":["20.1.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"4dbf50e548464243cd973401a2c51cd944d0f8a4e624cb085cc0fff19fb80935","tlsh":"1b610fe485ba023126b3d1e111170003bdb5e1733216eef436dc8a992f5bb2852b79ed"},{"path":"package.json","sha256":"dc809093e1b852fa51addc23bd9f3a804da33e00b54703a51bdee5314b8d6a31","tlsh":"95d0a9700e20693336c44aa9083a924aea728d3b0044b90817a335d891ab3b398bf32d"}],"package_integrity":[{"filename":"carbon-monorepo-20.1.1.tgz","hashes":{"sha1":"9b3db0a02676704fd25135237e19c5d04121d60f","sha512_sri":"sha512-Ax3XcICcupYH41Z1+0oFRvZzmrpbR1LxZrFCHHaWC4+T+zJ7v3AhpZE6rQ3i17lrOasDTsNRJsPMKftpQRgFuw=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/carbon-monorepo/v/20.1.1"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-018329","import_time":"2026-08-19T03:49:30.599223592Z","modified_time":"2026-08-19T03:41:18Z","sha256":"9c617e93833344e13d376182fb00c13994a4d2e7f3f8220998e541d77a8e8713","source":"amazon-inspector","versions":["20.1.1"]}]}}