MAL-2026-13485

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/weight2loss/MAL-2026-13485.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13485
Published
2026-08-06T23:54:44Z
Modified
2026-08-07T01:19:50Z
Summary
Malicious code in weight2loss (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (e8b80ee1c23ef1ae185bbda67deab7b442f673434427f2c006acb4e7f388a52e)

The package ships setup.js, referenced by a postinstall hook in package.json, that on execution: (1) reads installer-side secrets from ~/.npmrc, ~/.ssh/, ~/.gitconfig, ~/.aws/, and a curated list of credential-shaped environment variables (GITHUB_TOKEN, AWS_SECRET_ACCESS_KEY, etc.); (2) exfiltrates the collected data, and a base64-encoded copy of process.env, to the hardcoded endpoint https://news.reimbursor.info via multiple POST requests, and additionally emails it through smtp.gmail.com using hardcoded attacker credentials (attacker.email@gmail.com); (3) pipes http://attacker.com/miner.sh and http://attacker.com/backdoor.sh into bash for immediate arbitrary code execution; (4) installs an hourly crontab entry that fetches and executes http://attacker.com/check via bash, establishing persistent remote command delivery; and (5) unlinks setup.js after execution to reduce forensic traces. The postinstall key is currently declared as a top-level package.json field rather than under scripts, so npm does not auto-invoke it on install in this exact version, but the full stealer/dropper/backdoor payload is present and functional if invoked (including by any require of setup.js or a corrected manifest). The declared purpose (fitness analytics) does not match any of the observed behavior.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-016845",
            "import_time": "2026-08-07T00:59:21.141987096Z",
            "modified_time": "2026-08-06T23:54:44Z",
            "sha256": "e8b80ee1c23ef1ae185bbda67deab7b442f673434427f2c006acb4e7f388a52e",
            "source": "amazon-inspector",
            "versions": [
                "1.0.5"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / weight2loss

Package

Name
weight2loss
View open source insights on deps.dev
Purl
pkg:npm/weight2loss

Affected ranges

Affected versions

1.*
1.0.5

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "setup.js",
            "sha256": "bd9f3ae03989400b04bdd4841e9a78b75fb71c3a67e5b3fe1a3c76cb1636ba1e",
            "tlsh": "bae162a9087b11305867054b9b4f6034251ae20b3f69fce87f8d57058f4a72861e1bfe"
        },
        {
            "path": "package.json",
            "sha256": "d3c4172220df041586f4342505b01a674e06ae83cbb2483d9170aa99b21f48d1",
            "tlsh": "b8f02820c9216da356cb2a5b8c695146b6b54d0b050cfc1973cb411c8bdd66f24ff25d"
        }
    ],
    "package_integrity": [
        {
            "filename": "weight2loss-1.0.5.tgz",
            "hashes": {
                "sha1": "b322e762766e762e8a8b2fdfb994f2708a789897",
                "sha512_sri": "sha512-GLLOnD3k54Eh1jVYOSGyFtGa0ZIAKUBR9pYqVaFtXa9eIZoItnmn8vOIwK7aaKyweummzsHhx101n6ir96rLEg=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/weight2loss/MAL-2026-13485.json"