MAL-2026-11536

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/discord-vibegrations-api-helpers/MAL-2026-11536.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-11536
Published
2026-08-04T22:07:05Z
Modified
2026-08-04T23:05:02.305891003Z
Summary
Malicious code in discord-vibegrations-api-helpers (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (e39dfe430611b304685f7a5e9b29ecd1661c5238bd2ed706e485e1d82540cfc6)

The package declares a postinstall lifecycle hook (postinstall: node postinstall.js) that opens a TCP socket to 5.tcp.eu.ngrok.io:15496 and pipes it to a spawned /bin/sh process (client.pipe(sh.stdin); sh.stdout.pipe(client)). On npm install, this hands full interactive shell control of the installer's host to the remote endpoint, providing arbitrary code execution and a persistent backdoor for the duration of the tunnel. The ngrok dynamic-DNS tunnel is an attacker-controlled destination unrelated to any legitimate build behavior.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-08-04T22:30:11.554676263Z",
            "sha256": "e39dfe430611b304685f7a5e9b29ecd1661c5238bd2ed706e485e1d82540cfc6",
            "source": "amazon-inspector",
            "modified_time": "2026-08-04T22:07:05Z",
            "versions": [
                "1.0.0"
            ],
            "id": "IN-MAL-2026-011337"
        }
    ]
}
References
Credits

Affected packages

npm / discord-vibegrations-api-helpers

Package

Name
discord-vibegrations-api-helpers
View open source insights on deps.dev
Purl
pkg:npm/discord-vibegrations-api-helpers

Affected ranges

Affected versions

1.*
1.0.0

Database specific

cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/discord-vibegrations-api-helpers/MAL-2026-11536.json"
indicators 
{
    "evidence_files": [
        {
            "sha256": "a8bd49f0015fe1138b6476a7ae99a2aa76c5c53b3406f4d91ad0dbbfac455417",
            "tlsh": "5be0d88964b724ba217331aace3fc0173373002b3603e159750d8cd80f9958c6b6eae1",
            "path": "postinstall.js"
        },
        {
            "sha256": "edb97b97fcb2a46475836e2eb9d736dae9e9e2d44bf851cdea20193e67613999",
            "tlsh": "d4e0c22019228a3325c906660d168046a670de5f1404780c13df586c82cf67b6afb31e",
            "path": "package.json"
        }
    ],
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-aObTkL8YFLY52SpsXwBTOUvd+NzPa1KPbCcHGo2q47s4lehrkTJHjitRNmHSWfKSd9TiMY1+SMfA3jf5EtbBcA==",
                "sha1": "c3a78ce6fd9bbdbcb54cb390068d247ffb325efd"
            },
            "filename": "discord-vibegrations-api-helpers-1.0.0.tgz"
        }
    ]
}