catwrestlingbird

{"modified":"2026-09-21T03:30:37Z","published":"2026-09-21T03:30:37Z","schema_version":"1.7.4","id":"MAL-2026-16327","summary":"Malicious code in catwrestlingbird (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (80958afe2056e1a124791c9465abdb0fff080a33005cc332dd5c1869ab2ee4c0)\ncatwrestlingbird@1.0.0 declares a `postinstall` script (`node install.js`) that automatically runs on `npm install`. install.js collects installer host reconnaissance — hostname, username, platform/arch/OS release, network interfaces, a depth-3 listing of the current working directory, selected environment variables, and the output of `ss`/`netstat`, `arp`/`ip neigh`, and `ip route`/`route` — and POSTs the JSON payload to a hardcoded plain-HTTP endpoint at `http://192.168.4.216:3000/api/beacon`. install.js then spawns heartbeat.js as a detached, unref'd child process so it survives beyond install. heartbeat.js long-polls the same C2 every 60 seconds; on a `shell` task it upgrades to a WebSocket at `/ws/shell/<beacon_id>/open`, spawns `/bin/sh`, pipes the shell's stdout/stderr back to the server as WebSocket frames, and writes inbound WebSocket frames into the shell's stdin — a fully remote-controlled interactive shell on the installer's host, gated only by a hardcoded `x-beacon-secret`. A `kill` response from the C2 rewrites the installer's package.json and package-lock.json to remove the package and recursively deletes the package directory, providing a remote self-destruct/anti-forensics path. A SHA-256 hashcash proof-of-work handshake against `/api/pow` gates the beacon. The package description is empty and no functionality is advertised to the installer.\n","affected":[{"package":{"ecosystem":"npm","name":"catwrestlingbird"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"install.js","sha256":"b4eca6e15cee31ee81996857abe779c6260540c6c7e861a1f62945ab76d9bf24","tlsh":"4381b9e699f9b16407f7e2d8d61b99179153e4033207e9a0f78dc1902fca83c8166afd"},{"path":"heartbeat.js","sha256":"bb09b7393ea4a43c91d105f40645b2ddc79b059421df84c6027b0cadd6c22899","tlsh":"01b141969cf6133817f3a2df8a8b84162263e1477706e5e4b74d43541f8a12c81e2afd"}],"package_integrity":[{"filename":"catwrestlingbird-1.0.0.tgz","hashes":{"sha1":"a5c35a258bc9a62ee72bb49b46bf8725d8acac44","sha512_sri":"sha512-oelV2ju/ZQGQzvlipLUTJiNLCEEH0MfIvvZpxr9Qit4NB8ccLOTdszfBuonnfPdgfyVGbcuLr7hPt6bp4O37vA=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/catwrestlingbird/v/1.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-020229","import_time":"2026-09-21T03:46:37.924462113Z","modified_time":"2026-09-21T03:30:37Z","sha256":"80958afe2056e1a124791c9465abdb0fff080a33005cc332dd5c1869ab2ee4c0","source":"amazon-inspector","versions":["1.0.0"]}]}}