create-mono-package

{"modified":"2026-06-19T15:30:59Z","published":"2026-06-19T15:30:59Z","schema_version":"1.7.4","id":"MAL-2026-6222","summary":"Malicious code in create-mono-package (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (85402ef2db7bfd9e2bb01034a533e52649cf6058cc1e824e9c273aee5ae8121d)\nThe package's postinstall hook (.prepare.cjs) collects host fingerprint data (os.hostname(), os.userInfo().username, platform/arch, all non-internal network interface IPs, npm registry) plus a full dump of process.env (only keys prefixed with `npm_lifecycle` are filtered out) and HTTPS-POSTs the JSON payload to open.larksuite.com. Both the destination host and URL path are obfuscated: the hostname is built from a reversed charcode array with a -7 offset (`_hostDecoder`), and the path is XOR-decoded against key `Zk9x` (`_pathDecoder`). The send is wrapped in extensive sandbox/honeypot evasion — the script silently `process.exit(0)`s when env keys match analysis-pipeline prefixes (SANDYCLAW_, OPENCLAW_, PERMISO_, CHAINRADAR_, PYPI_POISON_, ASPECT_TLOG, THREAT_ANALYZER_MODEL) or when hostname/username matches patterns like detonat/cuckoo/virus/scan, and dummy values for GITHUB_TOKEN/NPM_TOKEN/AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY are explicitly skipped to avoid honeypots. On a real developer or CI machine, `npm install create-mono-package` ships every credential present in the environment (GitHub PATs, npm publish tokens, AWS keys, CI secrets, DB URIs) to the attacker-controlled Lark endpoint.\n","affected":[{"package":{"ecosystem":"npm","name":"create-mono-package"},"versions":["0.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":".prepare.cjs","sha256":"d17157828b17732d1577bf74528962b924d57f28f238f5df8fe3c31411ae84a4","tlsh":"ade131ced3a11ae5ab5108a3841e750a58b8c1231d2d92d8bcd4c2d77ff5b7056aa3fc"}],"package_integrity":[{"filename":"create-mono-package-0.0.0.tgz","hashes":{"sha1":"f133c5573aa364b7984148fef58c2644be9a0a71","sha512_sri":"sha512-wG7RylPjfCaEH18jgpZVo8n2NNo1az3itMLXNQ9iEfFzewIaTPn1rPEfh95fuJPbDf7BVsjZ6N1tIoEQXl1Fkg=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/create-mono-package/v/0.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-007081","import_time":"2026-06-19T15:41:55.80642884Z","modified_time":"2026-06-19T15:30:59Z","sha256":"85402ef2db7bfd9e2bb01034a533e52649cf6058cc1e824e9c273aee5ae8121d","source":"amazon-inspector","versions":["0.0.0"]}]}}