MAL-2026-11541

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/nagixjs/MAL-2026-11541.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-11541
Published
2026-08-04T22:06:17Z
Modified
2026-08-04T23:05:20.937997983Z
Summary
Malicious code in nagixjs (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (213429bfb5c1c93becdd4c0236cd167a277114e88f47cff28799c20c6d1e72dd)

package.json declares postinstall: node test.js, which loads index.js and auto-runs on npm install. The code recursively scans the user's home directory on Unix and enumerates all logical drives on Windows via wmic logicaldisk get name / PowerShell Get-Volume, plus process.cwd(). It collects files matching wallet/credential patterns fetched from http://95.216.118.146:3001/api/scan-patterns and hardcoded names including id.json, config.toml,.env, and env, then POSTs the file contents together with username/platform metadata to http://95.216.118.146:3001/api/v1 and http://95.216.118.146:3000/api/v1. On Linux, it additionally fetches an SSH public key from http://95.216.118.146:3001/api/ssh-key, appends it to $HOME/.ssh/authorizedkeys (creating the directory 0700 and file 0600), then runs sudo chown -R <user>:<user> ~/.ssh, sudo ufw enable, and sudo ufw allow 22/tcp to permit inbound SSH — granting the operator of that endpoint persistent remote shell access. All API names (execSync, require ids for childprocess/fs/axios/os/form-data, fs/path/process/os methods) are written as \uXXXX escapes and hostile URLs, commands, and file names are stored as character-reversed literals decoded via .split('').reverse().join(''), indicating deliberate evasion.

Database specific 
{
    "malicious-packages-origins": [
        {
            "source": "amazon-inspector",
            "modified_time": "2026-08-04T22:06:17Z",
            "sha256": "213429bfb5c1c93becdd4c0236cd167a277114e88f47cff28799c20c6d1e72dd",
            "id": "IN-MAL-2026-011332",
            "versions": [
                "2.1.6"
            ],
            "import_time": "2026-08-04T22:30:11.344716263Z"
        }
    ]
}
References
Credits

Affected packages

npm / nagixjs

Package

Name
nagixjs
View open source insights on deps.dev
Purl
pkg:npm/nagixjs

Affected ranges

Affected versions

2.*
2.1.6

Database specific

cwes 
[
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    }
]
indicators 
{
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-NgyU9GezA7DhL7gbDm+2F1LXueobcLiV+ggYXuakUxT2VFWg9+ytTS0k7KfAzCn5QzeXLy0w3lOEvpHEEJcb1g==",
                "sha1": "1e790fb7c8d6d6e3828be2833a6300583eb27fe1"
            },
            "filename": "nagixjs-2.1.6.tgz"
        }
    ],
    "evidence_files": [
        {
            "path": "index.js",
            "sha256": "10661c497fa986a623c5467e46a76891b0a25bae09223601b2b11df846864f61",
            "tlsh": "f372eea58377aebe99b16a108c357e2adcfc84b51fd7e019550b7848cc7a2e043d432d"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/nagixjs/MAL-2026-11541.json"