MAL-2026-14034

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/notafollower1/MAL-2026-14034.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-14034
Published
2026-08-14T14:06:58Z
Modified
2026-08-14T14:46:37Z
Summary
Malicious code in notafollower1 (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (7c74ec5369dac32115a9f5f257f512fa0a48d2e914b1f18c5178992b0a1604f9)

package.json declares a postinstall script that automatically runs on npm install and fetches AWS ECS container task metadata via the ECS_CONTAINER_METADATA_URI_V4 endpoint (task ARN, container names, image names), then POSTs the collected data to a hardcoded ngrok tunnel at https://mourner-slot-explicit.ngrok-free.dev using curl. The postinstall also inspects the container image name for substrings matching known security research operators (twbray, packagehound, wiz, oss-dynamic) and labels the payload accordingly, indicating deliberate sandbox and analyst fingerprinting. The destination is an anonymous ngrok tunnel unrelated to any legitimate publisher infrastructure, and the collected data reveals installer-side CI/build/container environment details to a third party.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-017765",
            "import_time": "2026-08-14T14:28:07.262635469Z",
            "modified_time": "2026-08-14T14:12:48Z",
            "sha256": "091cafb83b896477a8f1fc1641f1790d59ba5b85f5bbcff87575414c833243ed",
            "source": "amazon-inspector",
            "versions": [
                "1.0.1"
            ]
        },
        {
            "id": "IN-MAL-2026-017743",
            "import_time": "2026-08-14T14:28:05.001635625Z",
            "modified_time": "2026-08-14T14:09:28Z",
            "sha256": "74a5aad842ae4459d83b8c19a29f1b18810cee38b9028186cea3c5b14b54871e",
            "source": "amazon-inspector",
            "versions": [
                "1.0.13"
            ]
        },
        {
            "id": "IN-MAL-2026-017747",
            "import_time": "2026-08-14T14:28:05.414682437Z",
            "modified_time": "2026-08-14T14:10:08Z",
            "sha256": "a4dfb61823381aa2045568f06b09cba0934b1c7e7835089f282f4656bd3a298f",
            "source": "amazon-inspector",
            "versions": [
                "1.0.3"
            ]
        },
        {
            "id": "IN-MAL-2026-017734",
            "import_time": "2026-08-14T14:28:04.07446927Z",
            "modified_time": "2026-08-14T14:08:04Z",
            "sha256": "fe89c2f456042608dcf3de64627c2915927e1001278fdbaec028ebce70814885",
            "source": "amazon-inspector",
            "versions": [
                "1.0.8"
            ]
        },
        {
            "id": "IN-MAL-2026-017753",
            "import_time": "2026-08-14T14:28:05.952215553Z",
            "modified_time": "2026-08-14T14:11:06Z",
            "sha256": "0a351210edff8fb93c661275745fa9ca97166f51c94aa8cbc798011705649c10",
            "source": "amazon-inspector",
            "versions": [
                "1.0.7"
            ]
        },
        {
            "id": "IN-MAL-2026-017751",
            "import_time": "2026-08-14T14:28:05.795231671Z",
            "modified_time": "2026-08-14T14:10:49Z",
            "sha256": "185d90690759ac0bf5e675f796baadcc1ff6aa4bd2d80b7a09b388f08dd84fca",
            "source": "amazon-inspector",
            "versions": [
                "1.0.5"
            ]
        },
        {
            "id": "IN-MAL-2026-017737",
            "import_time": "2026-08-14T14:28:04.336889624Z",
            "modified_time": "2026-08-14T14:08:36Z",
            "sha256": "384e83f216e580c0fd3f2d56a2ab20c97b46375d4dbd4128254af462f4e93c3e",
            "source": "amazon-inspector",
            "versions": [
                "1.0.11"
            ]
        },
        {
            "id": "IN-MAL-2026-017741",
            "import_time": "2026-08-14T14:28:04.787103156Z",
            "modified_time": "2026-08-14T14:09:09Z",
            "sha256": "53fc5a6ac818157a2e95e5c291f80c7ffa530a233d4646581818cdd9aa5b85c9",
            "source": "amazon-inspector",
            "versions": [
                "1.0.12"
            ]
        },
        {
            "id": "IN-MAL-2026-017732",
            "import_time": "2026-08-14T14:28:03.80128191Z",
            "modified_time": "2026-08-14T14:07:48Z",
            "sha256": "7c74ec5369dac32115a9f5f257f512fa0a48d2e914b1f18c5178992b0a1604f9",
            "source": "amazon-inspector",
            "versions": [
                "1.0.9"
            ]
        },
        {
            "id": "IN-MAL-2026-017749",
            "import_time": "2026-08-14T14:28:05.598166623Z",
            "modified_time": "2026-08-14T14:10:23Z",
            "sha256": "1cc23d75386087eeceab1871b2c8b3aa0381a45972e910f457334ca8df5d0bf7",
            "source": "amazon-inspector",
            "versions": [
                "1.0.4"
            ]
        },
        {
            "id": "IN-MAL-2026-017726",
            "import_time": "2026-08-14T14:28:03.293091442Z",
            "modified_time": "2026-08-14T14:06:58Z",
            "sha256": "1e9f59224211c5b834225e61c33420528d064622314d824f2af9b423e71aa378",
            "source": "amazon-inspector",
            "versions": [
                "1.0.6"
            ]
        },
        {
            "id": "IN-MAL-2026-017736",
            "import_time": "2026-08-14T14:28:04.260805257Z",
            "modified_time": "2026-08-14T14:08:26Z",
            "sha256": "5241d5952af63a69847a219ddff9f457d7e21e03714f4a8db371df3e493ba3ff",
            "source": "amazon-inspector",
            "versions": [
                "1.0.10"
            ]
        },
        {
            "id": "IN-MAL-2026-017745",
            "import_time": "2026-08-14T14:28:05.195077252Z",
            "modified_time": "2026-08-14T14:09:45Z",
            "sha256": "589c0efe29f345435d1eea107e7a4448cc465510802f9005174c0bb3ac431f21",
            "source": "amazon-inspector",
            "versions": [
                "1.0.2"
            ]
        },
        {
            "id": "IN-MAL-2026-017738",
            "import_time": "2026-08-14T14:28:04.426461631Z",
            "modified_time": "2026-08-14T14:08:45Z",
            "sha256": "592bcb564cad8b98bd5cbfb2a8cde839814832f53603068a3067eb61f803d79d",
            "source": "amazon-inspector",
            "versions": [
                "1.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / notafollower1

Package

Name
notafollower1
View open source insights on deps.dev
Purl
pkg:npm/notafollower1

Affected ranges

Affected versions

1.*
1.0.0
1.0.1
1.0.2
1.0.3
1.0.4
1.0.5
1.0.6
1.0.7
1.0.8
1.0.9
1.0.10
1.0.11
1.0.12
1.0.13

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "package.json",
            "sha256": "49e38ef34cb96fdf426132a1b6832d38fd9618e70cc21c4f9d845bd34a26f5bd",
            "tlsh": "49f00e398d8d073338c88bac82109331edb12f435a09cb00b202038ed8a68618c15226"
        }
    ],
    "package_integrity": [
        {
            "filename": "notafollower1-1.0.1.tgz",
            "hashes": {
                "sha1": "a6bdbefc33981b32eb95225d25df287248389fca",
                "sha512_sri": "sha512-TuuvugE71/QuqdWl23Cmm7oKh2OibMw1rp+ghRKFUR9WoVfyVMylKMMcUMlAyzn0SF+44ZQv59TggocFKc6mww=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/notafollower1/MAL-2026-14034.json"