MAL-2026-13986

See a problem?

Import Source

https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/notafollower/MAL-2026-13986.json

JSON Data

https://api.osv.dev/v1/vulns/MAL-2026-13986

Published

2026-08-13T21:09:28Z

Modified

2026-08-13T21:30:16Z

Summary

Malicious code in notafollower (npm)

Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (e076dd548fea7ce80a77e7810b30c0a5d95c0b6ae4bf3d929281da70dbec1768)

notafollower@1.0.4 declares preinstall and postinstall lifecycle scripts that run inline Node code targeting the AWS EC2 Instance Metadata Service. The scripts request an IMDSv2 token from 169.254.169.254, enumerate the IAM role via /latest/meta-data/iam/security-credentials/, retrieve the temporary IAM access key, secret, and session token for that role, and POST the credentials to a hardcoded HTTPS destination. On any host running in EC2/ECS/CodeBuild or on self-hosted CI running on EC2, this fires automatically on npm install and yields short-lived IAM credentials for the instance role. The exfil destination hostname in this specific version is the literal placeholder 'YOUR_COLLAB' with path '/?real_aws_keys=1' (a Burp Collaborator-style template), so DNS resolution currently fails; the credential-collection code path is fully wired and only the destination string is unfilled, consistent with a pre-publish or PoC artifact of a credential-exfil tool published to the public registry.

Database specific

{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-017699",
            "import_time": "2026-08-13T21:20:58.193309765Z",
            "modified_time": "2026-08-13T21:10:36Z",
            "sha256": "14e54b91dbd6e04b340e4d2131c041eec613257845132d61852ff1e610c36b7e",
            "source": "amazon-inspector",
            "versions": [
                "1.0.3"
            ]
        },
        {
            "id": "IN-MAL-2026-017700",
            "import_time": "2026-08-13T21:20:58.253538511Z",
            "modified_time": "2026-08-13T21:10:52Z",
            "sha256": "577c63881ce5e284542cf767f4eaf35f73eb52880481341790d526bb197ad4dd",
            "source": "amazon-inspector",
            "versions": [
                "1.0.11"
            ]
        },
        {
            "id": "IN-MAL-2026-017692",
            "import_time": "2026-08-13T21:20:57.949175464Z",
            "modified_time": "2026-08-13T21:09:34Z",
            "sha256": "8d17108c386e3700400b3c6993a6d740164d86d9a7dac75f3d070e7f4ea21f03",
            "source": "amazon-inspector",
            "versions": [
                "1.0.8"
            ]
        },
        {
            "id": "IN-MAL-2026-017695",
            "import_time": "2026-08-13T21:20:58.052771388Z",
            "modified_time": "2026-08-13T21:09:57Z",
            "sha256": "90cd055da354b5fdd8dcb7ce868a24b3a14e748422d7e0388027aa178505f011",
            "source": "amazon-inspector",
            "versions": [
                "1.0.9"
            ]
        },
        {
            "id": "IN-MAL-2026-017694",
            "import_time": "2026-08-13T21:20:58.02733045Z",
            "modified_time": "2026-08-13T21:09:50Z",
            "sha256": "a373d4ff9917c534ceed89c9d5201cd91a42ecdb0a8830b360d26e7edccf17d9",
            "source": "amazon-inspector",
            "versions": [
                "1.0.0"
            ]
        },
        {
            "id": "IN-MAL-2026-017698",
            "import_time": "2026-08-13T21:20:58.168244186Z",
            "modified_time": "2026-08-13T21:10:28Z",
            "sha256": "b5c5f0c4a6e52de3fe50483b51bb4554787e51cdd4652e910cac66ebffdac408",
            "source": "amazon-inspector",
            "versions": [
                "1.0.2"
            ]
        },
        {
            "id": "IN-MAL-2026-017691",
            "import_time": "2026-08-13T21:20:57.916179126Z",
            "modified_time": "2026-08-13T21:09:28Z",
            "sha256": "ca0ec32325679dd5b47830e23f99b934f6697b21825ba9e1f3f4825edcd6d9a6",
            "source": "amazon-inspector",
            "versions": [
                "1.0.1"
            ]
        },
        {
            "id": "IN-MAL-2026-017696",
            "import_time": "2026-08-13T21:20:58.095389999Z",
            "modified_time": "2026-08-13T21:10:08Z",
            "sha256": "cde37949333bb259c373c8f38fcbac9918ce07be24123102602e50cc0d640547",
            "source": "amazon-inspector",
            "versions": [
                "1.0.5"
            ]
        },
        {
            "id": "IN-MAL-2026-017702",
            "import_time": "2026-08-13T21:20:58.327361652Z",
            "modified_time": "2026-08-13T21:11:10Z",
            "sha256": "e076dd548fea7ce80a77e7810b30c0a5d95c0b6ae4bf3d929281da70dbec1768",
            "source": "amazon-inspector",
            "versions": [
                "1.0.4"
            ]
        },
        {
            "id": "IN-MAL-2026-017693",
            "import_time": "2026-08-13T21:20:58.000344253Z",
            "modified_time": "2026-08-13T21:09:40Z",
            "sha256": "39a4d2426c7edbc7c5dd435977bf3b095e123ffd08673567bf9068189fa5981e",
            "source": "amazon-inspector",
            "versions": [
                "1.0.10"
            ]
        },
        {
            "id": "IN-MAL-2026-017701",
            "import_time": "2026-08-13T21:20:58.280234412Z",
            "modified_time": "2026-08-13T21:11:02Z",
            "sha256": "e85f4e4ce1e33d85fc2a6a95b18691ae34d7994e7ab9501a2f14539b4dde1eac",
            "source": "amazon-inspector",
            "versions": [
                "1.0.6"
            ]
        },
        {
            "id": "IN-MAL-2026-017697",
            "import_time": "2026-08-13T21:20:58.13578333Z",
            "modified_time": "2026-08-13T21:10:18Z",
            "sha256": "f87eb583a8066530f2ebf3cff370c28e4fd05b9d20865c26007ce2afdd454451",
            "source": "amazon-inspector",
            "versions": [
                "1.0.7"
            ]
        }
    ]
}

References

Credits

- Amazon Inspector - FINDER
- - inspector-research@amazon.com

Affected packages

npm / notafollower

Package

Name: notafollower; View open source insights on deps.dev
Purl: pkg:npm/notafollower

Affected ranges

Affected versions

1.*

1.0.0

1.0.1

1.0.2

1.0.3

1.0.4

1.0.5

1.0.6

1.0.7

1.0.8

1.0.9

1.0.10

1.0.11

Database specific

cwes

[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]

indicators

{
    "evidence_files": [
        {
            "path": "package.json",
            "sha256": "d88fbf9f7ab4ec10d9d24c2196d8b8eb77d2cd4196bdf5abae5b17f4031b6d06",
            "tlsh": "ff51ffe1d2aeb3a39f9c0b6ac865c7579626f80560060b9c9d9d1bd60c042d8f861fe8"
        }
    ],
    "package_integrity": [
        {
            "filename": "notafollower-1.0.3.tgz",
            "hashes": {
                "sha1": "f52bbc0d5fc56d95da1f1382354aa621a538b8d2",
                "sha512_sri": "sha512-9o6ITpTZ1CVJx0TMeZU3CCWNe9psgBNFF97yqOfS39iSviBWK6ZJOS955Zk1kvT/Yqn0nsfvKsP3ILOG8iMrFg=="
            }
        }
    ]
}

source

"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/notafollower/MAL-2026-13986.json"