MAL-2026-10944

The zer0onetencent package was published to the npm registry by user 't2423048543' (maintainer email t2423048543@gmail.com). It is described as 'A simple date formatting utility' but ships no such functionality; index.js only exports a hello() stub returning the package name, indicating a package created to deliver an install-time payload.

The package.json declares a postinstall hook ("node postinstall.js") that runs automatically at npm install time. The bundled postinstall.js embeds a shell command chain that performs cloud-metadata SSRF and credential/environment harvesting: it queries a public IP echo service (http://cip.cc), probes a Meituan/Sankuai internal SSRF test endpoint (https://mtsrc-test.sankuai.com/ssrf), requests AWS EC2 instance metadata credentials for the IAM role 'sandyclaw-canary-worker-role' (http://169.254.169.254/latest/meta-data/iam/security-credentials/sandyclaw-canary-worker-role), and reads Tencent Cloud metadata (http://metadata.tencentyun.com/latest/meta-data/ and http://169.254.0.23/latest/meta-data/). It then reads the installing process's environment via /proc/self/environ and exfiltrates the concatenated output, together with a directory listing of /data/, by HTTP POST to the attacker-controlled Burp Collaborator endpoint http://t5z0g2hzoydgi8mz3pfkzg8dm4svgl4a.oastify.com (paths /metadata and /data).

As shipped, the malicious command chain is stored inside postinstall.js as a JSON document (a copy of a package manifest) rather than as executable JavaScript, so the 'node postinstall.js' hook raises a syntax error and the embedded payload does not execute as-published; the intent and payload are nonetheless unambiguously malicious. A sibling package (zer0onetencent2) by the same maintainer carries an identical payload differing only in the Collaborator subdomain.

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (db63abb2f3fa01d1de98c5b63e2b7cde88f35ddb18a752e670dc982fc0ddcc89)

The package is presented as 'A simple date formatting utility' with a trivial index.js exporting a hello() function, but its postinstall lifecycle script executes a shell one-liner that queries cloud instance metadata services — the AWS IMDS role credentials endpoint at 169.254.169.254 (path /latest/meta-data/iam/security-credentials/sandyclaw-canary-worker-role), the Tencent Cloud metadata service at metadata.tencentyun.com, and an additional internal SSRF endpoint — writes the responses to /tmp, reads /proc/self/environ, then POSTs the aggregated output to the hardcoded Burp Collaborator subdomain t5z0g2hzoydgi8mz3pfkzg8dm4svgl4a.oastify.com. Running on cloud build infrastructure yields short-lived IAM/STS credentials and installer environment variables to the operator of that collaborator host. The stated package purpose is a decoy for the install-time credential-harvest behavior.