MAL-2026-12315

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@cryptosrvc/no-brainer-sdk/MAL-2026-12315.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12315
Published
2026-08-05T13:01:29Z
Modified
2026-08-05T13:35:08.341450639Z
Summary
Malicious code in @cryptosrvc/no-brainer-sdk (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (7955af180bb00f4f97b5dee0c7020f9e43f4c35aa84c5ef5446dd95646eb333b)

On npm install, the package's postinstall script (dist/recon.js) collects installer-side host reconnaissance — hostname, username, SUDOUSER, home directory, cwd, network interfaces including internal IPs, DNS domain via dnsdomainname, and npm lifecycle context — and enumerates process.env, filtering the key names against a regex targeting AWS, GCP, AZURE, NPM, NODEAUTH, DOCKER, KUBE, VAULT, TOKEN, SECRET, KEY, PASS, CRED, GITHUB, GITLAB, and SSH. Both the full env-name list and the credential-shaped subset are serialized and POSTed as JSON over plain HTTP to hardcoded bare IP 138.68.108.20:80/cb, with a npm-install-telemetry/1.0 User-Agent and an inline comment framing the payload as 'NON-SENSITIVE telemetry only' despite including sudo_user, internal network layout, and credential env-var name inventory. Behavior fires automatically as a postinstall lifecycle hook.

Database specific 
{
    "malicious-packages-origins": [
        {
            "source": "amazon-inspector",
            "sha256": "7955af180bb00f4f97b5dee0c7020f9e43f4c35aa84c5ef5446dd95646eb333b",
            "versions": [
                "1.0.18"
            ],
            "import_time": "2026-08-05T13:08:51.129287555Z",
            "modified_time": "2026-08-05T13:01:29Z",
            "id": "IN-MAL-2026-014852"
        }
    ]
}
References
Credits

Affected packages

npm / @cryptosrvc/no-brainer-sdk

Package

Name
@cryptosrvc/no-brainer-sdk
View open source insights on deps.dev
Purl
pkg:npm/%40cryptosrvc/no-brainer-sdk

Affected ranges

Affected versions

1.*
1.0.18

Database specific

indicators 
{
    "package_integrity": [
        {
            "hashes": {
                "sha1": "990c558d941ce3becbf0848a0df7bff8ea19bb3b",
                "sha512_sri": "sha512-5PB+n/9sHEpyUt+9swY8npyI6cjBzKej1kWyIS3rJUIuTCtTFusYtWRsNPvjbkJjOCduNNSs1/1tfwCokVbJ9A=="
            },
            "filename": "no-brainer-sdk-1.0.18.tgz"
        }
    ],
    "evidence_files": [
        {
            "path": "dist/recon.js",
            "sha256": "cf516a4fddaeeec18aa158b24503fb532cb928411b6720ee31516e9b00510057",
            "tlsh": "0c51845612b92532229256a9366b10013233f0273f85f9d8bddc13611fcd42d41f6bed"
        }
    ]
}
cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@cryptosrvc/no-brainer-sdk/MAL-2026-12315.json"