cminhouse-api-gateway-nodejs

{"modified":"2026-09-02T04:25:25Z","published":"2026-09-02T03:56:59Z","schema_version":"1.7.4","id":"MAL-2026-15815","summary":"Malicious code in cminhouse-api-gateway-nodejs (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (c42971bbb30a4cb0a1da27be3953339fdbda449e4d10e997aac72212df0a8b1d)\nindex.js is wired as the package's `postinstall` script and also runs on `require` via `main`. After skipping CI/test/Docker environments (guards on NODE_ENV=test, CI, JEST_WORKER_ID, VITEST, /.dockerenv) and applying a random 5-15 second delay, it walks the installer's home directory and reads SSH private keys (~/.ssh/*), AWS credentials (~/.aws), Azure access tokens (~/.azure), gcloud config (~/.config/gcloud), Kubernetes, Docker, Terraform, GitHub, Vercel, Netlify, Supabase, and Firebase configuration files,.npmrc/.yarnrc,.netrc,.pgpass, database rc files, PyPI/cargo/gem credentials, and a HuggingFace token. It also iterates process.env selecting any variable whose name matches TOKEN/KEY/SECRET/PASSWORD/etc. The collected payload is base64-encoded and POSTed to a hardcoded bare-IP VPS at http://2.26.82.63:8888/collect, and host reconnaissance (username, hostname, platform, arch, cwd, node version) is separately sent to api.telegram.org via a hardcoded bot token and chat id with a '🎯 NEW VICTIM' tag. Sandbox-evasion gating, randomized delay, victim-tagging language, and a bare-IP exfiltration endpoint are all consistent with a targeted supply-chain credential-theft payload.\n","affected":[{"package":{"ecosystem":"npm","name":"cminhouse-api-gateway-nodejs"},"versions":["999.0.0","999.0.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"999f8a9c61271524ab9c28c05f23af03617d4c0ea8fc522e2240ae2fea82a4fd","tlsh":"6d32688b4db5215a8133f379df2f8007d52ea6a361028e467b2c88d11f79458db91fdc"}],"package_integrity":[{"filename":"cminhouse-api-gateway-nodejs-999.0.0.tgz","hashes":{"sha1":"dd571b3426e60d59398e3005fe34f63b3b3e7617","sha512_sri":"sha512-bLU09UytzUTJ1lstlGBzkZgVOXk9qxpu8KQTiRSK+sYNUmBxgCdhhisv5G+DrsBVwHxpLEROh9AjplGjh1tYmg=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/cminhouse-api-gateway-nodejs/v/999.0.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/cminhouse-api-gateway-nodejs/v/999.0.1"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-019325","import_time":"2026-09-02T04:23:33.095711427Z","modified_time":"2026-09-02T03:57:15Z","sha256":"aefd4c32579606510c75e36e72893eade4234a559b49acce562cd74f252c432b","source":"amazon-inspector","versions":["999.0.0"]},{"id":"IN-MAL-2026-019323","import_time":"2026-09-02T04:23:32.875050681Z","modified_time":"2026-09-02T03:56:59Z","sha256":"c42971bbb30a4cb0a1da27be3953339fdbda449e4d10e997aac72212df0a8b1d","source":"amazon-inspector","versions":["999.0.1"]}]}}