MAL-2026-16327

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/catwrestlingbird/MAL-2026-16327.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-16327
Published
2026-09-21T03:30:37Z
Modified
2026-09-21T04:00:06Z
Summary
Malicious code in catwrestlingbird (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (80958afe2056e1a124791c9465abdb0fff080a33005cc332dd5c1869ab2ee4c0)

catwrestlingbird@1.0.0 declares a postinstall script (node install.js) that automatically runs on npm install. install.js collects installer host reconnaissance — hostname, username, platform/arch/OS release, network interfaces, a depth-3 listing of the current working directory, selected environment variables, and the output of ss/netstat, arp/ip neigh, and ip route/route — and POSTs the JSON payload to a hardcoded plain-HTTP endpoint at http://192.168.4.216:3000/api/beacon. install.js then spawns heartbeat.js as a detached, unref'd child process so it survives beyond install. heartbeat.js long-polls the same C2 every 60 seconds; on a shell task it upgrades to a WebSocket at /ws/shell/<beacon_id>/open, spawns /bin/sh, pipes the shell's stdout/stderr back to the server as WebSocket frames, and writes inbound WebSocket frames into the shell's stdin — a fully remote-controlled interactive shell on the installer's host, gated only by a hardcoded x-beacon-secret. A kill response from the C2 rewrites the installer's package.json and package-lock.json to remove the package and recursively deletes the package directory, providing a remote self-destruct/anti-forensics path. A SHA-256 hashcash proof-of-work handshake against /api/pow gates the beacon. The package description is empty and no functionality is advertised to the installer.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-020229",
            "import_time": "2026-09-21T03:46:37.924462113Z",
            "modified_time": "2026-09-21T03:30:37Z",
            "sha256": "80958afe2056e1a124791c9465abdb0fff080a33005cc332dd5c1869ab2ee4c0",
            "source": "amazon-inspector",
            "versions": [
                "1.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / catwrestlingbird

Package

Name
catwrestlingbird
View open source insights on deps.dev
Purl
pkg:npm/catwrestlingbird

Affected ranges

Affected versions

1.*
1.0.0

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "install.js",
            "sha256": "b4eca6e15cee31ee81996857abe779c6260540c6c7e861a1f62945ab76d9bf24",
            "tlsh": "4381b9e699f9b16407f7e2d8d61b99179153e4033207e9a0f78dc1902fca83c8166afd"
        },
        {
            "path": "heartbeat.js",
            "sha256": "bb09b7393ea4a43c91d105f40645b2ddc79b059421df84c6027b0cadd6c22899",
            "tlsh": "01b141969cf6133817f3a2df8a8b84162263e1477706e5e4b74d43541f8a12c81e2afd"
        }
    ],
    "package_integrity": [
        {
            "filename": "catwrestlingbird-1.0.0.tgz",
            "hashes": {
                "sha1": "a5c35a258bc9a62ee72bb49b46bf8725d8acac44",
                "sha512_sri": "sha512-oelV2ju/ZQGQzvlipLUTJiNLCEEH0MfIvvZpxr9Qit4NB8ccLOTdszfBuonnfPdgfyVGbcuLr7hPt6bp4O37vA=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/catwrestlingbird/MAL-2026-16327.json"