@traktis/environment

{"modified":"2026-09-16T14:21:35Z","published":"2026-09-16T13:59:51Z","schema_version":"1.7.4","id":"MAL-2026-16223","summary":"Malicious code in @traktis/environment (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (6b9bdabc95f4e8bc70e348557c1cae7d2447d9bd1405ac7a23945ded47ec04a8)\npackage.json declares preinstall and postinstall lifecycle scripts that invoke curl against the hardcoded cleartext endpoint http://tko.amgsec.com/depconf/traktis-environment/, sending the output of whoami, hostname, cwd, a timestamp, and a base64-encoded dump of CI/build environment variables matched by the pattern GITHUB_*, CI_PROJECT, JENKINS_URL, BUILD_URL, GITLAB_*, RUNNER_*, HOSTNAME, USER, HOME as query parameters. index.js is a 55-byte placeholder comment and author is listed as 'anonymous'; the manifest lifecycle scripts are the entire functional payload. The name occupies the @traktis scope at version 99.99.2, a version-inflation shape consistent with dependency-confusion resolution against an internal package of the same name. Installing the package on any developer workstation or CI runner automatically transmits build-system identity and any credential-shaped environment variables covered by the grep pattern to a third-party host over plain HTTP.\n","affected":[{"package":{"ecosystem":"npm","name":"@traktis/environment"},"versions":["99.99.1","99.99.2"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"package.json","sha256":"4caf376753d003931fa41a280611328c9b553451951f3a8b252d111d86bda97d","tlsh":"22f05c38a43958333fc065781adc430e79819b5745e47c197343cc881e5cabb116522e"}],"package_integrity":[{"filename":"environment-99.99.1.tgz","hashes":{"sha1":"c4f97ce03c526fa14e5c7120dcef20bd850c3058","sha512_sri":"sha512-2/eWPg54CVBQw68uFeFUQuf7NdTuhfF7qoiqvJU2205re+Vpvd1vQbNqGiboFXgwTQEkMA3IsCF5DHpaG6Q2yQ=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@traktis/environment/v/99.99.1"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@traktis/environment/v/99.99.2"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-020108","import_time":"2026-09-16T14:19:38.424257173Z","modified_time":"2026-09-16T13:59:59Z","sha256":"6251d6386b6cccebe9a36ec4046a1d21361289c90fc0172658e4bed979c866cc","source":"amazon-inspector","versions":["99.99.1"]},{"id":"IN-MAL-2026-020107","import_time":"2026-09-16T14:19:38.345197704Z","modified_time":"2026-09-16T13:59:51Z","sha256":"6b9bdabc95f4e8bc70e348557c1cae7d2447d9bd1405ac7a23945ded47ec04a8","source":"amazon-inspector","versions":["99.99.2"]}]}}