MAL-2026-13484

See a problem?

Import Source

https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/merge-grid-stats/MAL-2026-13484.json

JSON Data

https://api.osv.dev/v1/vulns/MAL-2026-13484

Published

2026-08-06T23:57:08Z

Modified

2026-08-07T01:19:50.107139538Z

Summary

Malicious code in merge-grid-stats (npm)

Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (65aa3700b74bc0d50e4a4ee4fb3b903af0ac2ebea5867a3d1ffd0876647ec2a1)

Package advertises itself as a 2048-style grid game statistics utility, but its declared postinstall hook (node install-cb.js) executes on npm install and performs behavior unrelated to that purpose. The postinstall shells out via execSync to run uname -a and id, reads /proc/1/cgroup and /proc/mounts, inspects Linux capabilities, checks for /var/run/docker.sock, and reads the Kubernetes service-account token and namespace at /var/run/secrets/kubernetes.io/serviceaccount/. It also enumerates /, /root, /root/projects, performs a host write-test, inspects network configuration, and greps the process environment for variables matching token|secret|key|password|db_|redis|s3 and related patterns. The collected data (including the k8s SA token length and env keys) is written to NCODE_ESCAPE.txt in the current working directory and two parent directories. Author metadata is placeholder-shaped (merge-tools <merge-tools@example.com>) and the README/behavior mismatch indicates a cover-story shape. The install-time read of an installer-owned Kubernetes service-account token plus environment secret enumeration constitutes installer-side credential access and container-escape reconnaissance staging.

Database specific

{
    "malicious-packages-origins": [
        {
            "modified_time": "2026-08-06T23:57:57Z",
            "source": "amazon-inspector",
            "sha256": "480edc24e9ce55e418b450a537402834259af05ee7f4b8e37a2d567c88c16d33",
            "import_time": "2026-08-07T00:59:22.389263602Z",
            "id": "IN-MAL-2026-016857",
            "versions": [
                "1.2.0"
            ]
        },
        {
            "source": "amazon-inspector",
            "modified_time": "2026-08-06T23:57:50Z",
            "sha256": "f32ba46f634d1cc25a1f23c2e6750d48df721cda4255e15308ed7861753bc1fe",
            "import_time": "2026-08-07T00:59:22.293674868Z",
            "id": "IN-MAL-2026-016856",
            "versions": [
                "1.3.0"
            ]
        },
        {
            "modified_time": "2026-08-06T23:57:40Z",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-016855",
            "import_time": "2026-08-07T00:59:22.201448023Z",
            "sha256": "65aa3700b74bc0d50e4a4ee4fb3b903af0ac2ebea5867a3d1ffd0876647ec2a1",
            "versions": [
                "1.4.0"
            ]
        },
        {
            "modified_time": "2026-08-06T23:57:08Z",
            "source": "amazon-inspector",
            "sha256": "8acac0f86860c41407583785cf4111e1ed3603c089fdafc43f13b67555b44530",
            "import_time": "2026-08-07T00:59:22.028764828Z",
            "id": "IN-MAL-2026-016853",
            "versions": [
                "1.5.0"
            ]
        },
        {
            "modified_time": "2026-08-06T23:58:04Z",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-016858",
            "import_time": "2026-08-07T00:59:22.487659167Z",
            "sha256": "9ee8fb4f530a10ef6654671f16801c19a5d6b62341236e768aa427d99ae3f99b",
            "versions": [
                "1.1.0"
            ]
        },
        {
            "modified_time": "2026-08-06T23:58:14Z",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-016859",
            "import_time": "2026-08-07T00:59:22.599171846Z",
            "sha256": "c2667c86658cd12a305c38bd9930970107e85438ce0063384d7be66035351f8a",
            "versions": [
                "1.0.1"
            ]
        },
        {
            "modified_time": "2026-08-06T23:58:22Z",
            "source": "amazon-inspector",
            "sha256": "c6b4931ac12bfa5bdfdb7880717cb59543e10e5924c97110a7671162e814d4c7",
            "import_time": "2026-08-07T00:59:22.692267008Z",
            "id": "IN-MAL-2026-016860",
            "versions": [
                "1.0.0"
            ]
        }
    ]
}

References

Credits

- Amazon Inspector - FINDER
- - inspector-research@amazon.com

Affected packages

npm / merge-grid-stats

Package

Name: merge-grid-stats; View open source insights on deps.dev
Purl: pkg:npm/merge-grid-stats

Affected ranges

Affected versions

1.*

1.0.0

1.0.1

1.1.0

1.2.0

1.3.0

1.4.0

1.5.0

Database specific

indicators

{
    "package_integrity": [
        {
            "filename": "merge-grid-stats-1.2.0.tgz",
            "hashes": {
                "sha512_sri": "sha512-w9YFM6f+znQk0IVl9jIw15jxLTNbvA1VHhxh+ufNdUUqlvQ5BZex9MB2ExQbE7lCTKYK2M0jI/bUTyapvNgqug==",
                "sha1": "05255762f00beb66f8f7a895da4e85256c43dc20"
            }
        }
    ],
    "evidence_files": [
        {
            "tlsh": "de4152ced1f6b0a553b2b3a8c22f03193563c1c74949de24fd9d43626f604782a218ed",
            "sha256": "051e6a7d32321dba37a5f64d67e3b5e108f8eafea2d43e60d6d1dd5ad0c5e9dc",
            "path": "install-cb.js"
        },
        {
            "tlsh": "e8f08b258935a5231ac627a058197045b2e34d4b411cfc2c27df043ed28e66f157f7ba",
            "sha256": "455501c6655f9392fa4fdbcbad525687f4321a19670152ee5f289f73e7d789ee",
            "path": "package.json"
        }
    ]
}

source

"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/merge-grid-stats/MAL-2026-13484.json"

cwes

[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    },
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    },
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    },
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]