ledgerflow-deploy-utils

{"modified":"2026-07-09T22:58:20Z","published":"2026-06-29T07:09:41Z","schema_version":"1.7.4","id":"MAL-2026-6591","summary":"Malicious code in ledgerflow-deploy-utils (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (5f0097d19be676ac30ff79dffcff38f128873c80115a8a150c3eceff0422aa93)\nOn npm install, the package's postinstall script queries the AWS instance metadata service (IMDSv1) at 169.254.169.254 for the attached IAM role and POSTs the result, along with an IMDS-reachability probe, over plain HTTP to a hardcoded bare IP (54.226.194.239:80/chain3). The published library surface (index.js) only exports two no-op console.log stubs named validate/deploy, with no real functionality — the entire effective behavior is the install-time reconnaissance against AWS-hosted installers and CI runners. The combination of a placeholder API, a generic deployment-utility name suggesting an internal/private package, and install-time recon to a hardcoded bare-IP C2 matches the dependency-confusion / internal-name-squat pattern targeting corporate build systems, where exposed IAM role names enable follow-on credential abuse against the installer's cloud environment.\n","affected":[{"package":{"ecosystem":"npm","name":"ledgerflow-deploy-utils"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"versions":["1.0.1","1.0.4","1.0.3","1.0.5"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"postinstall.js","sha256":"3a8a53135dc01cb00b57a53e0a486396720a5cb67718ceb56d52e287f251d52f","tlsh":"2d011ee8b2f161360bb7c22ca19a790b6514900e14af9e04ba841f64bf4833edc70de8"},{"path":"index.js","sha256":"920bc0303c24f08b00e81cb2ad6996abca1290398e1a45c8b9ace2c831193cfe","tlsh":"54c04c946e6922691e3a60e49482942bb1d04f51850aa06435ac67a600c4e5940fa4f9"}],"package_integrity":[{"filename":"ledgerflow-deploy-utils-1.0.1.tgz","hashes":{"sha1":"3e383072ccd84fe57a1b06ce1384b0605f53a6b0","sha512_sri":"sha512-EZE79itTKpYHeL1bwhfxQ80UD86J71sH3DKF+Igh57Q8Z4cRkl1WXubR6Yn99RDJELtcd4/AsKNSX3x7oGILCQ=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/ledgerflow-deploy-utils/v/1.0.1"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/ledgerflow-deploy-utils/v/1.0.4"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/ledgerflow-deploy-utils/v/1.0.3"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/ledgerflow-deploy-utils/v/1.0.5"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"source":"amazon-inspector","sha256":"5f0097d19be676ac30ff79dffcff38f128873c80115a8a150c3eceff0422aa93","import_time":"2026-06-29T09:10:16.293553336Z","id":"IN-MAL-2026-007771","modified_time":"2026-06-29T07:09:41Z","ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"versions":["1.0.1"]},{"source":"amazon-inspector","sha256":"c71c7c058d110084aad3e60b9f2a6fb62c313bb57a7ebcedca41c18c114af8a6","import_time":"2026-07-09T17:19:27.124558915Z","id":"IN-MAL-2026-009346","modified_time":"2026-07-09T16:59:02Z","versions":["1.0.4"]},{"source":"amazon-inspector","sha256":"633e014b6d0a58342a7073f97a61af225dcaef7a40021cf557a90eb6487b74bb","import_time":"2026-07-09T17:19:26.990455919Z","id":"IN-MAL-2026-009345","modified_time":"2026-07-09T16:58:55Z","versions":["1.0.3"]},{"source":"amazon-inspector","sha256":"6a526ef69d243b60570a6caabf4a86a78c4f68bf43164fc3e40596cae83ded26","import_time":"2026-07-09T22:56:33.72252926Z","id":"IN-MAL-2026-009552","modified_time":"2026-07-09T22:12:31Z","versions":["1.0.5"]}]}}