thevoid

{"modified":"2026-05-26T05:55:04Z","published":"2026-05-22T16:40:24Z","schema_version":"1.7.4","id":"MAL-2026-4692","summary":"Malicious code in thevoid (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (0ce4d125de5d699da897d074134f8d1f0a971aa23d9c3d6ff3330015fccad091)\nOn install, postinstall.js performs an HTTPS request to void-relay.com carrying process.env contents along with host identifiers (process.platform, process.arch). The destination is not associated with any documented publisher SDK or runtime CDN, and the data exfiltrated (full environment variables plus host fingerprint) constitutes installer-side secret leakage. This matches the canonical hardcoded-C2 exfiltration shape: a lifecycle script (postinstall.js line 38) issues https.get to a hardcoded attacker-controlled host (void-relay.com, line 22) with environment data attached. Any developer or CI runner that installs this package will leak its environment (which routinely contains API tokens, cloud credentials, and CI secrets) to the attacker.\n","affected":[{"package":{"ecosystem":"npm","name":"thevoid"},"versions":["0.1.4","0.1.3"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"domains":["void-relay.com","github.com","release-assets.githubusercontent.com"],"evidence_files":[{"path":"postinstall.js","sha256":"97f3da706360cb68e608de85d9c16b85fddc0cb2c365936b4c9e25c95228164d","tlsh":"6c6185cd06f6623507b192a5851f896be77694123116da80f23d32a47fc2178c633afe"}],"package_integrity":[{"filename":"thevoid-0.1.4.tgz","hashes":{"sha1":"6c430076768eb5946400bf6af1dd8b5d57969a78","sha512_sri":"sha512-oOQ/a3RC6j8Qaw/ADDqQMcn5Nqra1I5SDU0iHDvPKutLD0goAMed7yMDPwvIS701DAUvMApLtxV9WTmUCeoirQ=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/thevoid/v/0.1.4"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/thevoid/v/0.1.3"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["actran@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-004259","import_time":"2026-05-26T05:52:15.187319709Z","modified_time":"2026-05-22T20:44:35Z","sha256":"0ce4d125de5d699da897d074134f8d1f0a971aa23d9c3d6ff3330015fccad091","source":"amazon-inspector","versions":["0.1.4"]},{"id":"IN-MAL-2026-004260","import_time":"2026-05-26T05:52:15.321549529Z","modified_time":"2026-05-22T20:44:35Z","sha256":"27287e9af97748818989eb46a4435e8684d75760a428b8d9054f080bfd1fa660","source":"amazon-inspector","versions":["0.1.4"]},{"id":"IN-MAL-2026-004228","import_time":"2026-05-26T05:52:11.740289221Z","modified_time":"2026-05-22T16:40:25Z","sha256":"47489953ce40d6c0f085ec6baf20a035de70f73694d6b8be5025d63c82205886","source":"amazon-inspector","versions":["0.1.3"]},{"id":"IN-MAL-2026-004227","import_time":"2026-05-26T05:52:11.645713034Z","modified_time":"2026-05-22T16:40:24Z","sha256":"5c620020be938a746e20906905f09b52960636a2c53c649f64c9971257b655e9","source":"amazon-inspector","versions":["0.1.3"]}]}}