zer0onedate

{"modified":"2026-06-11T00:02:55Z","published":"2026-06-10T23:55:02Z","schema_version":"1.7.4","id":"MAL-2026-5535","summary":"Malicious code in zer0onedate (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (106494bfe4420962c30d8b3989a1397d197f277079c71b8d15695c9128d72399)\nOn `npm install`, postinstall.js executes a chain of `curl` commands that read cloud instance metadata service (IMDS) endpoints — AWS (169.254.169.254/latest/meta-data/iam/security-credentials/), Alibaba/Aliyun and Tencent metadata hosts, plus 100.100.100.200 and 169.254.0.23 — and writes the responses to /tmp/aws.txt, /tmp/ali.txt, /tmp/meituan.txt. It also probes an internal-looking SSRF endpoint at https://mtsrc-test.sankuai.com/ssrf and lists /data/. The aggregated contents are POSTed via `curl -X POST -d` to http://h4mx6b7krgzarfehbutwabxbu20tojc8.oastify.com/metadata, an attacker-controlled Burp Collaborator subdomain. Any installer running in AWS/Aliyun/Tencent cloud (CI runners, build agents, cloud dev VMs) leaks temporary IAM credentials from IMDS to the attacker, who can then pivot into the victim's cloud account. The targeting of Meituan-internal infrastructure (sankuai.com) plus multiple non-standard cloud metadata IPs indicates deliberate reconnaissance, not opportunistic theft.\n","affected":[{"package":{"ecosystem":"npm","name":"zer0onedate"},"versions":["1.0.0","1.0.2"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"postinstall.js","sha256":"9d8d2cd48eda895baf0e8ab87b60534ea8d1d7242e06303ae3617f223747a151","tlsh":"f9018e983611b9726d865f7ad379030ef400f95b1fc4ab94c2a61cf0494da61f06db08"}],"package_integrity":[{"filename":"zer0onedate-1.0.0.tgz","hashes":{"sha1":"81a574eb90087330b35e5211170c74ae802f1822","sha512_sri":"sha512-moIirCOoF2AhWJm3oqnDecmfquLY/HU+EQtcCKyh2B8wZ7TjcYThPZzEkcVforrxQ4qCkzDxCtoRFPaI9i1Swg=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/zer0onedate/v/1.0.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/zer0onedate/v/1.0.2"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-005329","import_time":"2026-06-11T00:00:59.231341291Z","modified_time":"2026-06-10T23:55:15Z","sha256":"106494bfe4420962c30d8b3989a1397d197f277079c71b8d15695c9128d72399","source":"amazon-inspector","versions":["1.0.0"]},{"id":"IN-MAL-2026-005328","import_time":"2026-06-11T00:00:59.116812182Z","modified_time":"2026-06-10T23:55:02Z","sha256":"d6d3b1cca8ae0369474912f980f89947449995895ed0238ac2444063dbd957e1","source":"amazon-inspector","versions":["1.0.2"]}]}}