@vraksha/gh-helper

{"modified":"2026-07-08T18:08:50Z","published":"2026-07-08T18:08:50Z","schema_version":"1.7.4","id":"MAL-2026-7016","summary":"Malicious code in @vraksha/gh-helper (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (8c867b4c68acc159dea1bbd580c5de3f3c9fef7bd1f54cd48a02c59631ffda12)\nOn `npm install`, the package's postinstall hook runs index.js, which performs an HTTPS GET to https://http-logger-production.up.railway.app/payload, base64-decodes the response body (Buffer.from(data.trim(), 'base64').toString('utf-8')), and passes the decoded string to child_process.execSync with { shell: '/bin/bash' }. This is a fetch-decode-exec dropper: the executed content is attacker-controlled, mutable, and opaque, and it runs automatically at install time with the installer's privileges. No legitimate purpose (no shipped native source requiring a build, no vendor-matched SDK, no pinned artifact) justifies this pattern.\n","affected":[{"package":{"ecosystem":"npm","name":"@vraksha/gh-helper"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"943a5d8635002550096aa6c0fe76ed06316388485c13b2208a4c2676a5a660da","tlsh":"0df005f4e6b862744b7298c82547ec5af543a02237c5fb9275dc10469f855f022fa3e8"}],"package_integrity":[{"filename":"gh-helper-1.0.0.tgz","hashes":{"sha1":"f0b239079119267338eee4972294a88d3c8497c6","sha512_sri":"sha512-Gq74eZy7JVVsMKWgk7prFUIdmjKxdvEyuVtnLQk1DVI/GMnqVzkYYHh9XIjNozfZW+ohmzk5sSKe0bSRklOaoA=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@vraksha/gh-helper/v/1.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-008175","import_time":"2026-07-08T18:34:24.572459158Z","modified_time":"2026-07-08T18:08:50Z","sha256":"8c867b4c68acc159dea1bbd580c5de3f3c9fef7bd1f54cd48a02c59631ffda12","source":"amazon-inspector","versions":["1.0.0"]}]}}