hemi-earn-actions

{"schema_version":"1.7.4","id":"MAL-2026-5778","published":"2026-06-15T15:09:30Z","modified":"2026-09-01T11:20:26.898763169Z","aliases":["GHSA-hjwc-fchg-m65q"],"summary":"Malicious code in hemi-earn-actions (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (a9c2a72c75e835bc78738de0839bd4727df93d6bcb8aed2215289973996c4f3c)\nOn `npm install`, the package's preinstall script (postinstall.js) collects host metadata (hostname, username, cwd, npm config) and iterates process.env, filtering keys against the regex /key|secret|token|pass|private|ssh|deploy|auth|api|rpc|wallet|sentry|docker|graph|slack|host/i to harvest credential-shaped variables. The resulting JSON payload is POSTed over HTTPS to a hardcoded bare-IP endpoint, https://185.130.46.35:8443/collect. The package itself has no functional API — index.js is `module.exports = {}` — and the version `999.0.0` plus the description 'Internal package' fit the dependency-confusion pattern aimed at organizations that resolve a private name `hemi-earn-actions` from the public registry. Installer harm is automatic credential exfiltration of CI/developer secrets to attacker-controlled infrastructure.\n","affected":[{"package":{"name":"hemi-earn-actions","ecosystem":"npm"},"versions":["999.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"postinstall.js","sha256":"d64656e6553409a54557222ecca0d2d914ac89afab42f95780168653327962f3","tlsh":"ef0141f884ed95a226e797d8f117901761bbd2323d0678b0baa842851fcc27485f2cf2"},{"path":"package.json","sha256":"50a27c879a9e9f4b9341cafe62fe9a5764168097d16804c38dff74c64a551718","tlsh":"49c022308c106b7318c407c218a3800061b14c2b1000681c47c3204003bbbb208ab30d"}],"package_integrity":[{"filename":"hemi-earn-actions-999.0.0.tgz","hashes":{"sha1":"55e7e26acd74386fe884bb74a5e52b5dc82370a1","sha512_sri":"sha512-867QqQR9OAyWv1JZ24Vei2qoG/nOisC9T1SSmrSNDvjGNTJdLPt81EnJJABWXFAao0G7rNxKcjQRGC4Jrt3Y9g=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/hemi-earn-actions/v/999.0.0"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-hjwc-fchg-m65q"}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-006485","import_time":"2026-06-15T15:30:21.81547569Z","modified_time":"2026-06-15T15:09:30Z","sha256":"a9c2a72c75e835bc78738de0839bd4727df93d6bcb8aed2215289973996c4f3c","source":"amazon-inspector","versions":["999.0.0"]},{"id":"RLMA-2026-05551","import_time":"2026-07-20T13:14:47.358961401Z","modified_time":"2026-07-20T10:45:57Z","sha256":"15aa3614adec73ffa9de8130ac188b4e014bc8b1eeeac73916c6512fb10273c7","source":"reversing-labs","versions":["999.0.0"]},{"id":"RLUA-2026-06269","import_time":"2026-09-01T11:18:08.547822745Z","modified_time":"2026-08-24T16:54:41Z","sha256":"50908ed0cf5b0a741ea692fb41cfee0795614e45a1f736a3361f299f61e51ead","source":"reversing-labs"}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"ReversingLabs","contact":["https://www.reversinglabs.com"],"type":"FINDER"}]}