spc-grafeno-login

{"modified":"2026-08-31T18:02:27Z","published":"2026-08-31T18:02:27Z","schema_version":"1.7.4","id":"MAL-2026-15633","summary":"Malicious code in spc-grafeno-login (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (01c074fc169a09169385a53a74ea0bc928f45bf20d40621d7c4b4657e28c01f2)\nThe package's preinstall.js lifecycle script auto-executes on npm install and performs two attacker-benefiting actions against the installer. First, it enumerates process.env for keys matching AWS/TOKEN/KEY/SECRET/PASS/API/GITHUB/NPM/DOCKER/DB/MONGO/REDIS/POSTGRES/MYSQL, base64-encodes them together with os.hostname(), os.userInfo().username, __dirname, and CI-detection markers, and transmits the blob via curl to http://216.126.236.46/r.php over plain HTTP. Second, on non-Windows hosts it spawns a reverse shell to 216.126.236.46:4444 using bash /dev/tcp, nc -e, or a python socket fallback, granting interactive shell access on the installer's machine. Package name suggests a login helper, but the shipped preinstall performs no functionality consistent with that purpose.\n","affected":[{"package":{"ecosystem":"npm","name":"spc-grafeno-login"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"preinstall.js","sha256":"1a0234425be06b1c7b6805d201808eab6b091634c52aa6d3ca663b4f69dd734e","tlsh":"f52140f0a2ba31a48f624ad07796847a35fee3023721d9d02a2c515a8f42b6015f34ef"}],"package_integrity":[{"filename":"spc-grafeno-login-1.0.0.tgz","hashes":{"sha1":"ed4c0b8b4de2324f48368817dec380ceb87a0969","sha512_sri":"sha512-xtTo6/9ne69dpkP/fLgUHoxPA8Dfqb2Vx9q3qEYK3xX9+Cf8+/yf8e6GLig4pknFOKy/eG+zJxSVa+9WTo0sWA=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/spc-grafeno-login/v/1.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-019304","import_time":"2026-08-31T18:22:29.473827468Z","modified_time":"2026-08-31T18:02:27Z","sha256":"01c074fc169a09169385a53a74ea0bc928f45bf20d40621d7c4b4657e28c01f2","source":"amazon-inspector","versions":["1.0.0"]}]}}