ripshakti

{"modified":"2026-06-30T20:59:31Z","published":"2026-06-30T20:59:31Z","schema_version":"1.7.4","id":"MAL-2026-6701","summary":"Malicious code in ripshakti (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (aa7ce8c4b0c7a25d70f9043d4208694cdef5ad174aa493ee9e9097ea6693a668)\nThe package's preinstall lifecycle hook (scripts.preinstall = \"node index.js\") auto-executes index.js on `npm install`. The script queries the AWS instance metadata service at 169.254.169.254 for IAM security credentials, instance identity, user-data and network metadata, reads ECS container credentials endpoints, and enumerates process.env filtering for keys matching /key|secret|token|pass|auth|cred|api|aws|database|db_|mongo|redis|s3|sqs|sns|lambda|role/i. Collected data is base64-encoded and POSTed to a hardcoded out-of-band collector at https://9x7dxkrzy9hpff6ds3y1umla218swik7.oastify.com. Any developer, CI runner, or EC2/ECS host that runs `npm install` for this package has its cloud IAM role credentials and environment secrets exfiltrated to an attacker-controlled endpoint.\n","affected":[{"package":{"ecosystem":"npm","name":"ripshakti"},"versions":["80.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"89432734c409cc5f4492d1ec20e8b16d59fa81b7824b27241795f508e18e9597","tlsh":"6571614962fb51030c7789eed2dbf01a5626f0073a81de88b6fc0f440f85529b263ae9"},{"path":"package.json","sha256":"1c74b67aa4a798d14d6522e9183e6b1a8cc25b8df380c82398e4b265e08efbe9","tlsh":"a7d05e345d61593315c506a6082ea446a6a1cf2f1408380993db183c91de67798ff35d"}],"package_integrity":[{"filename":"ripshakti-80.0.0.tgz","hashes":{"sha1":"3edd94ed2d01565b96a4c8dc20a00f6c199ac8aa","sha512_sri":"sha512-u7w3sQT7RG8075trIm+zk8rGO6NJcjR4HvK8f6TMKOlauGRBpS/FLjQ5o8g5Lc6eHS1aRpOACMVE6wefbUpOEQ=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/ripshakti/v/80.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-007816","import_time":"2026-06-30T21:35:49.94984278Z","modified_time":"2026-06-30T20:59:31Z","sha256":"aa7ce8c4b0c7a25d70f9043d4208694cdef5ad174aa493ee9e9097ea6693a668","source":"amazon-inspector","versions":["80.0.0"]}]}}