MAL-2026-11043

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/supplyhub/MAL-2026-11043.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-11043
Published
2026-07-20T00:00:00Z
Modified
2026-08-15T16:15:12Z
Summary
Malicious code in supplyhub (npm)
Details

The npm package supplyhub is a credential / SSH-key stealer. Its package.json declares a postinstall lifecycle hook (postinstall: node postinstall.js) that executes automatically on npm install, before the package is ever imported.

postinstall.js uses fs.readFileSync to read the user's SSH private key (~/.ssh/id_rsa) and the process environment (/proc/self/environ — where CI/cloud tokens and npm tokens live), and gathers account/host identity via os.userInfo(); it also references /etc/passwd. The collected data is exfiltrated by HTTP POST to a hard-coded webhook.site dead-drop: https://webhook.site/3c9418b3-cacd-403d-b42e-e9e4a9508fe3.

Only version 1.0.2 is malicious: version 1.0.0 (held in the codelake corpus) is clean — the exfiltration code was introduced in the 1.0.2 release (a trust-then-poison pattern). Any workstation or CI runner that installs supplyhub@1.0.2 (directly or transitively) hands its SSH key and environment secrets to the operator. Detected and classified independently by codelake Research from the live npm feed on 2026-07-20; not present in OSV or GHSA at the time of reporting (a first-catch).

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (e0d6286c7aa72597cf47fca7e9db99799909ceba09490f4a185b359e71f63590)

supplyhub@1.0.1 ships a postinstall.js that runs automatically on npm install and collects installer host identifiers (os.hostname(), os.userInfo().username, process.cwd(), pid, platform, arch, node version) along with CI-related environment variables (CI, RENOVATE_VERSION), then transmits them as query parameters to a hardcoded webhook.site endpoint (https://webhook.site/3c9418b3-cacd-403d-b42e-e9e4a9508fe3) using https.get with http and execSync('curl...' || wget...) fallbacks. The package.json description self-labels this as a dependency-confusion PoC targeting the 'Travix supplyhub' name, but the tarball is published to public npm and will execute the install-time beacon against any installer that resolves this name, including unrelated users who typo or whose internal builds dependency-confuse into it.

Database specific 
{
    "iocs": {
        "hashes": [
            "sha256:bd13913906ed463642719633f36f04cf10ae6f9c9360fcde842f8b6b1daf0b02"
        ],
        "urls": [
            "https://webhook.site/3c9418b3-cacd-403d-b42e-e9e4a9508fe3"
        ]
    },
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-010919",
            "import_time": "2026-07-28T14:19:59.088898742Z",
            "modified_time": "2026-07-28T13:36:22Z",
            "sha256": "5e2b4c51e7fa4bd04e5d26bc5b263e677a555626a1f346d4e9e1e0cd5041d494",
            "source": "amazon-inspector",
            "versions": [
                "1.0.2"
            ]
        },
        {
            "id": "IN-MAL-2026-017962",
            "import_time": "2026-08-15T16:07:56.838356258Z",
            "modified_time": "2026-08-15T15:58:05Z",
            "sha256": "e0d6286c7aa72597cf47fca7e9db99799909ceba09490f4a185b359e71f63590",
            "source": "amazon-inspector",
            "versions": [
                "1.0.1"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / supplyhub

Package

Name
supplyhub
View open source insights on deps.dev
Purl
pkg:npm/supplyhub

Affected ranges

Affected versions

1.*
1.0.1
1.0.2

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "postinstall.js",
            "sha256": "c4890cd6b962584a1a19555db697942a1d8c8a0e6416b52e3832890cec6e073f",
            "tlsh": "0d210ff686a89c2522b59190961e3105f9e6e1110fc5bdf0c0f8c25f7becaf40a76d3a"
        }
    ],
    "package_integrity": [
        {
            "filename": "supplyhub-1.0.2.tgz",
            "hashes": {
                "sha1": "c2e7b02bcc2586a5ddbbdb3cb84a1ea4af2bc94e",
                "sha512_sri": "sha512-BdAUvbfBIHYT1hCq0z2kqlPb8KQ2vucb/CYosF7bFSLu0UUckZJs9bJwYwgN+ihZX8STxijPApHe7QdFNr2uFw=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/supplyhub/MAL-2026-11043.json"