module-index-cache

{"modified":"2026-06-30T21:37:40Z","published":"2026-06-30T21:00:00Z","schema_version":"1.7.4","id":"MAL-2026-6700","summary":"Malicious code in module-index-cache (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (d3b789fbaaf21d9554aa580105d73d992d4a82963e1ade3c6dca6290f5cd7a3e)\npackage.json declares preinstall, install, and postinstall hooks that all invoke install.js, so the payload runs unconditionally on `npm install`. install.js reads installer-side secrets and host data — /app/.env, /root/.npmrc, /home/node/.npmrc, /etc/npmrc, /app/.git/config, package.json, /proc/self/environ, and the full process.env (JSON-stringified, sliced to 15000 chars) — runs shell reconnaissance (id, hostname, whoami, ls, ps, find/grep for flag files), base64-encodes the bundle, and POSTs/PUTs it via http.request to the hardcoded endpoint http://154.57.164.76:30728/api/modules/ECT-839201. The tarball additionally ships publish-and-arm.sh and arm-aliases.sh, which document and automate publishing the package under aliases (curse-dependent, spectral-corsair, @spectral-corsair/cursed-modules) using `npm:module-index-cache@1.0.2` redirection — explicitly labeled `dependency-confusion` and `armed-alias-public-npm` — to weaponize name confusion against private-registry consumers. A CTF/cover-story framing in comments does not change the installer impact: any machine that installs this package leaks its environment variables, npm auth tokens, dotenv contents, git configuration, and selected source/filesystem data to an attacker-controlled host.\n","affected":[{"package":{"ecosystem":"npm","name":"module-index-cache"},"versions":["1.0.1","1.0.0","1.0.2"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"install.js","sha256":"5a4125c2c23ce80a01b1b8c311fcc2512712bff48849d06cce88a6895c191482","tlsh":"7f81d7d9fef9811273e8b95536a64403bee7e67324197c903c491ad03fcc8ad02325ab"},{"path":"publish-and-arm.sh","sha256":"597031dcb0a3e14212126e85b226c068bf3bf3e822488bc6f0710812dc551c72","tlsh":"2e114683643a70b3c48fab81f504533157f7b5eb241b3520ddcc35e927aa1fd926916a"}],"package_integrity":[{"filename":"module-index-cache-1.0.1.tgz","hashes":{"sha1":"0d7832df4f45f5c5499926e64f133a52ac022e2f","sha512_sri":"sha512-sFR9HBbqg+DKTzHUtPEP9jxI029YDM1xO4h+ZA69YVi1TplWvrtz3gk4/B0ldXdNtXf2b0YT2Ue9TFBiM5iaEA=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/module-index-cache/v/1.0.1"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/module-index-cache/v/1.0.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/module-index-cache/v/1.0.2"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-007819","import_time":"2026-06-30T21:35:50.443857523Z","modified_time":"2026-06-30T21:00:08Z","sha256":"9a947e4f5dba43d2cfe0428514bf4a787fc8f3d538fe5482b54508cc1c732099","source":"amazon-inspector","versions":["1.0.1"]},{"id":"IN-MAL-2026-007818","import_time":"2026-06-30T21:35:50.324911778Z","modified_time":"2026-06-30T21:00:00Z","sha256":"cf55b479f7a8b550b2c5661e990f8cb3cff0d6c25886da004ada85d401f39372","source":"amazon-inspector","versions":["1.0.0"]},{"id":"IN-MAL-2026-007820","import_time":"2026-06-30T21:35:50.597601082Z","modified_time":"2026-06-30T21:00:15Z","sha256":"d3b789fbaaf21d9554aa580105d73d992d4a82963e1ade3c6dca6290f5cd7a3e","source":"amazon-inspector","versions":["1.0.2"]}]}}