harness-skil

{"modified":"2026-05-26T05:55:02Z","published":"2026-05-24T06:05:18Z","schema_version":"1.7.4","id":"MAL-2026-4577","summary":"Malicious code in harness-skil (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (e03ab8467953cd2233e07e792a33c7df7be2c99c66da3b814538a169337b93e6)\nThe package's install.js (wired to an npm install lifecycle hook) requires child_process, fs, and https, then issues an https.get to a raw.githubusercontent.com URL and writes/executes the fetched content with environment variables passed through. Fetching code from a personal/raw GitHub user content URL — a mutable, non-publisher, non-version-pinned source — and running it as part of `npm install` is the canonical install-time dropper shape: any installer of harness-skil executes whatever bytes currently live at that URL, with no integrity check or pinning. The package's name does not indicate a legitimate need to download external code at install time, and the destination is not a publisher-owned or known runtime CDN.\n","affected":[{"package":{"ecosystem":"npm","name":"harness-skil"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"domains":["raw.githubusercontent.com"],"evidence_files":[{"path":"install.js","sha256":"123a9e76ca57e3f3ebe58048fb20fe1e42c409e70842c064eca56296b44cfdf8","tlsh":"7d51216e48f786305773a4882b5b401b746699032259db58b76c472affc1a38c2069ff"}],"package_integrity":[{"filename":"harness-skil-1.0.0.tgz","hashes":{"sha1":"de0854b1029861dcf104cd6eb5c4f9686f84dc5e","sha512_sri":"sha512-Cg5wFqIEMRpOA4hwb6ISxts+uzuXfPTvTwPHadIaJQWIDdVkZIimCwRCrNpXvSfq/u0bVTOkoCD7Wi7wz37rdw=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/harness-skil/v/1.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["actran@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-004468","import_time":"2026-05-26T05:52:39.528723343Z","modified_time":"2026-05-24T06:05:19Z","sha256":"45ebe57d4bef636497d4588feca853441fd83299640ef1e1d772eca62121d396","source":"amazon-inspector","versions":["1.0.0"]},{"id":"IN-MAL-2026-004467","import_time":"2026-05-26T05:52:39.41309522Z","modified_time":"2026-05-24T06:05:18Z","sha256":"e03ab8467953cd2233e07e792a33c7df7be2c99c66da3b814538a169337b93e6","source":"amazon-inspector","versions":["1.0.0"]}]}}