MAL-2026-11537

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/discord-vibegrations-api-natives/MAL-2026-11537.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-11537
Published
2026-08-04T22:05:57Z
Modified
2026-08-04T23:05:01.253865113Z
Summary
Malicious code in discord-vibegrations-api-natives (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (9cb64ecc29aa68ec4659bab280f4ffd2c3de889cc966c0974f85b0c488edc603)

On npm install, the package's postinstall.js opens a TCP socket to 5.tcp.eu.ngrok.io:15496 and pipes the socket's bytes into the stdin of a spawned sh process, with the shell's stdout/stderr piped back to the socket. The package.json declares "postinstall": "node postinstall.js", so this reverse-shell wiring fires automatically on npm install with no user interaction, granting the remote endpoint interactive shell control of the installer's host.

Database specific 
{
    "malicious-packages-origins": [
        {
            "modified_time": "2026-08-04T22:05:57Z",
            "source": "amazon-inspector",
            "sha256": "9cb64ecc29aa68ec4659bab280f4ffd2c3de889cc966c0974f85b0c488edc603",
            "import_time": "2026-08-04T22:30:11.219393001Z",
            "id": "IN-MAL-2026-011330",
            "versions": [
                "1.0.5"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / discord-vibegrations-api-natives

Package

Name
discord-vibegrations-api-natives
View open source insights on deps.dev
Purl
pkg:npm/discord-vibegrations-api-natives

Affected ranges

Affected versions

1.*
1.0.5

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    }
]
indicators 
{
    "package_integrity": [
        {
            "filename": "discord-vibegrations-api-natives-1.0.5.tgz",
            "hashes": {
                "sha512_sri": "sha512-qgX99Xbl1OfmnhkbWmVMmd/wHts/2pAf60iqIaqRjx/7EkyZ7TgEmnHC63D+ZpPzYIOjeMHAU/FJaVO1vr8dbg==",
                "sha1": "578cb8fae781531d5a38c08482e8b2cd2ad4d20f"
            }
        }
    ],
    "evidence_files": [
        {
            "tlsh": "5be0d88964b724ba217331aace3fc0173373002b3603e159750d8cd80f9958c6b6eae1",
            "sha256": "a8bd49f0015fe1138b6476a7ae99a2aa76c5c53b3406f4d91ad0dbbfac455417",
            "path": "postinstall.js"
        },
        {
            "tlsh": "0ae0c2201a62963325c506260d168186a670de5f1404780c13df586cc2cf6776afb32f",
            "sha256": "fef693cce02efa542ea406815113ad58b319b7f474945ae0588014879590b639",
            "path": "package.json"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/discord-vibegrations-api-natives/MAL-2026-11537.json"