MAL-2026-11043

The npm package supplyhub is a credential / SSH-key stealer. Its package.json declares a postinstall lifecycle hook (postinstall: node postinstall.js) that executes automatically on npm install, before the package is ever imported.

postinstall.js uses fs.readFileSync to read the user's SSH private key (~/.ssh/id_rsa) and the process environment (/proc/self/environ — where CI/cloud tokens and npm tokens live), and gathers account/host identity via os.userInfo(); it also references /etc/passwd. The collected data is exfiltrated by HTTP POST to a hard-coded webhook.site dead-drop: https://webhook.site/3c9418b3-cacd-403d-b42e-e9e4a9508fe3.

Only version 1.0.2 is malicious: version 1.0.0 (held in the codelake corpus) is clean — the exfiltration code was introduced in the 1.0.2 release (a trust-then-poison pattern). Any workstation or CI runner that installs supplyhub@1.0.2 (directly or transitively) hands its SSH key and environment secrets to the operator. Detected and classified independently by codelake Research from the live npm feed on 2026-07-20; not present in OSV or GHSA at the time of reporting (a first-catch).