MAL-2026-16137

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/cr-bot-common/MAL-2026-16137.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-16137
Published
2026-09-11T22:39:55Z
Modified
2026-09-11T23:30:06Z
Summary
Malicious code in cr-bot-common (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (ddd83408820ca65c51cea223a061260109332ba408ca3a43ba00ef827f1ad74f)

preinstall.js and postinstall.js execute automatically on npm install. preinstall.js reads.env files from the current and parent directories, walks the working directory and home directory for files matching *.key, *.pem, id_rsa, id_ed25519, wallet.json, keystore.json, and mnemonic.txt, collects process.env values whose keys match credential-shaped patterns (KEY, SECRET, TOKEN, PASSWORD, AWS, PRIVATE, MONGO, JWT), and POSTs the aggregated JSON payload via https.request to https://attacker.com/collect. postinstall.js additionally captures hostname, user, uid/gid, cloud/container context (Docker, Kubernetes, AWS, GCP, Azure), and reads file contents from /root, /home, and /opt matching key/pem/mnemonic/wallet/keystore/secret, then POSTs to https://attacker.com/exfiltrate. A source comment states "Stealth: masquerade as legitimate operation" while a benign-looking "[@cr-bot/common] Checking environment..." message is printed and network errors are silently swallowed.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-020012",
            "import_time": "2026-09-11T23:15:30.037659035Z",
            "modified_time": "2026-09-11T22:39:55Z",
            "sha256": "ddd83408820ca65c51cea223a061260109332ba408ca3a43ba00ef827f1ad74f",
            "source": "amazon-inspector",
            "versions": [
                "1.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / cr-bot-common

Package

Name
cr-bot-common
View open source insights on deps.dev
Purl
pkg:npm/cr-bot-common

Affected ranges

Affected versions

1.*
1.0.0

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "preinstall.js",
            "sha256": "4c95fa41b94184dfcccdb9d62f19aa07348188eb6b76348861a34a8ba238713e",
            "tlsh": "6a815262d5be572001e36294578f91112a29e2133b01ad987fcc9344ffc596c40f3afe"
        },
        {
            "path": "postinstall.js",
            "sha256": "71079d423fd366996818b57845b4851fae6f8c0f9df04f0f4403297f595d461d",
            "tlsh": "79d13526c5be9b1100d3723a5b4f6201666af0077f04bd993fdd8345af8aa5c41f36ae"
        }
    ],
    "package_integrity": [
        {
            "filename": "cr-bot-common-1.0.0.tgz",
            "hashes": {
                "sha1": "e85d51eb7b8784f7c72b81461011f8dd47ccf5b4",
                "sha512_sri": "sha512-PKn9ciEoJW7of9u4+nAqINx+W/0+FLAyygjnyWsglGO7sN7T0LN1w+aTPNYNYt80OmTuadaUQwYsldNpUHnAKw=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/cr-bot-common/MAL-2026-16137.json"