MAL-2026-14177

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/fast-glob-fast/MAL-2026-14177.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-14177
Published
2026-08-18T23:49:26Z
Modified
2026-08-19T03:00:13.589858113Z
Summary
Malicious code in fast-glob-fast (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (7695ac02a2492bbf3118fc68514378edb201a93183f2dcb0035727781f31d408)

fast-glob-fast is a name-squat of the popular fast-glob package (its repository field even points at mrmlnc/fast-glob). The declared postinstall hook node scripts/postinstall-test.mjs computes the installer's ~/.ssh/authorized_keys path per-platform (darwin/linux/win32), creates ~/.ssh at mode 0700 if missing, and appends to authorized_keys at mode 0600 via appendFileSync. The same script defines a top-level constant DEFAULT_TEXT = 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5... dkhrustalev' — a staged attacker ed25519 public key. Appending any key line to authorizedkeys grants passwordless SSH login as the installing user; even though the current build only appends comment lines, the primitive, the target file, and the embedded attacker key together form a persistence/remote-access dropper wired to run automatically on npm install. The same postinstall additionally collects username, hostname, non-internal MAC address, platform, and arch, and POSTs them as a JSON systemInfo event (optionally with a bearer token) to a URL taken from FAST_GLOB_FAST_EVENT_URL, reporting the outcome of the authorizedkeys write — a reporting channel co-located with the backdoor primitive.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-08-19T00:21:11.232866091Z",
            "sha256": "06e1d99a3a1c42a611ef74cf3716f3caad1df91ace6c19d448daaa140f8e5c1c",
            "modified_time": "2026-08-18T23:56:21Z",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-018231",
            "versions": [
                "11.0.0"
            ]
        },
        {
            "import_time": "2026-08-19T00:21:10.746130191Z",
            "sha256": "92ced9e788505da600a8b79bef3678101e5a0480e6b8ddb754e9472c8a63cf63",
            "modified_time": "2026-08-18T23:49:26Z",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-018226",
            "versions": [
                "9.0.0"
            ]
        },
        {
            "import_time": "2026-08-19T02:57:21.941471119Z",
            "sha256": "d0b15e32c14394ed90eb53c8e33652c9e1be44bb3aa29a1e0341831f2a07996e",
            "modified_time": "2026-08-19T02:44:05Z",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-018298",
            "versions": [
                "4.0.1"
            ]
        },
        {
            "import_time": "2026-08-19T02:57:21.687355122Z",
            "sha256": "f30cb2af0de95b99ad26614e9e2ac080aabcabc45db443b106cb5127c500ef10",
            "modified_time": "2026-08-19T02:43:47Z",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-018296",
            "versions": [
                "10.0.0"
            ]
        },
        {
            "import_time": "2026-08-19T02:57:21.82782249Z",
            "source": "amazon-inspector",
            "modified_time": "2026-08-19T02:43:54Z",
            "sha256": "7695ac02a2492bbf3118fc68514378edb201a93183f2dcb0035727781f31d408",
            "id": "IN-MAL-2026-018297",
            "versions": [
                "0.2.0"
            ]
        },
        {
            "import_time": "2026-08-19T02:57:21.548558494Z",
            "sha256": "81597420047bbddb80acd01006ebf15f9cb637c95e6b9232f79f23fde6689388",
            "modified_time": "2026-08-19T02:43:36Z",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-018295",
            "versions": [
                "8.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / fast-glob-fast

Package

Name
fast-glob-fast
View open source insights on deps.dev
Purl
pkg:npm/fast-glob-fast

Affected ranges

Affected versions

0.*
0.2.0
4.*
4.0.1
8.*
8.0.0
9.*
9.0.0
10.*
10.0.0
11.*
11.0.0

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/fast-glob-fast/MAL-2026-14177.json"
indicators 
{
    "evidence_files": [
        {
            "sha256": "9b6d962d0b1b1dde0044b95afa6746dde1db88d71f5cb69781dcec744c73e032",
            "tlsh": "b0a1961563f016305b6a217e064a10337275e013261e9cacb2ddcb547f972a99e73aed",
            "path": "scripts/postinstall-test.mjs"
        },
        {
            "sha256": "61a395ffc1383da0f936a9ced3b1020437dd5071fc0446c66c6a44e157e990ca",
            "path": "package.json",
            "tlsh": "1c617856dc69cdf309c36166bcb80ab1b62028531f99f80e7326527d0b2e82f10bc97d"
        }
    ],
    "package_integrity": [
        {
            "filename": "fast-glob-fast-11.0.0.tgz",
            "hashes": {
                "sha512_sri": "sha512-WMxM8oNgJxspcdaJCvKKcUtbyKu3/1kD2r4FRYfBPNAxQ/136rFsgYQWePJn943DGHO79pe0WNvjoUCSlhGjVg==",
                "sha1": "b1e8141a54f1b99b6fb679d921c0420fddfd1c23"
            }
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    },
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    }
]