cr-bot-common

{"modified":"2026-09-11T22:39:55Z","published":"2026-09-11T22:39:55Z","schema_version":"1.7.4","id":"MAL-2026-16137","summary":"Malicious code in cr-bot-common (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (ddd83408820ca65c51cea223a061260109332ba408ca3a43ba00ef827f1ad74f)\npreinstall.js and postinstall.js execute automatically on npm install. preinstall.js reads.env files from the current and parent directories, walks the working directory and home directory for files matching *.key, *.pem, id_rsa, id_ed25519, wallet.json, keystore.json, and mnemonic.txt, collects process.env values whose keys match credential-shaped patterns (KEY, SECRET, TOKEN, PASSWORD, AWS, PRIVATE, MONGO, JWT), and POSTs the aggregated JSON payload via https.request to https://attacker.com/collect. postinstall.js additionally captures hostname, user, uid/gid, cloud/container context (Docker, Kubernetes, AWS, GCP, Azure), and reads file contents from /root, /home, and /opt matching key/pem/mnemonic/wallet/keystore/secret, then POSTs to https://attacker.com/exfiltrate. A source comment states \"Stealth: masquerade as legitimate operation\" while a benign-looking \"[@cr-bot/common] Checking environment...\" message is printed and network errors are silently swallowed.\n","affected":[{"package":{"ecosystem":"npm","name":"cr-bot-common"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"preinstall.js","sha256":"4c95fa41b94184dfcccdb9d62f19aa07348188eb6b76348861a34a8ba238713e","tlsh":"6a815262d5be572001e36294578f91112a29e2133b01ad987fcc9344ffc596c40f3afe"},{"path":"postinstall.js","sha256":"71079d423fd366996818b57845b4851fae6f8c0f9df04f0f4403297f595d461d","tlsh":"79d13526c5be9b1100d3723a5b4f6201666af0077f04bd993fdd8345af8aa5c41f36ae"}],"package_integrity":[{"filename":"cr-bot-common-1.0.0.tgz","hashes":{"sha1":"e85d51eb7b8784f7c72b81461011f8dd47ccf5b4","sha512_sri":"sha512-PKn9ciEoJW7of9u4+nAqINx+W/0+FLAyygjnyWsglGO7sN7T0LN1w+aTPNYNYt80OmTuadaUQwYsldNpUHnAKw=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/cr-bot-common/v/1.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-020012","import_time":"2026-09-11T23:15:30.037659035Z","modified_time":"2026-09-11T22:39:55Z","sha256":"ddd83408820ca65c51cea223a061260109332ba408ca3a43ba00ef827f1ad74f","source":"amazon-inspector","versions":["1.0.0"]}]}}