MAL-2026-18375

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@dmangal/curse-dependent-ecto/MAL-2026-18375.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-18375
Published
2026-10-29T14:53:35Z
Modified
2026-10-29T15:30:05Z
Summary
Malicious code in @dmangal/curse-dependent-ecto (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (28b6b5c8c100680386dbcbbd51dd409f67f0d54701eb0e50232934acc53bf397)

The package's binding.gyp contains a GYP command-expansion action that is executed automatically by node-gyp during npm install. The embedded node -e script runs grep -rl 'HTB{' /workspace/ /root/ /tmp/ /opt/ /var/ /etc/ across installer-side paths, reads /tmp/scent-trail.jsonl and /workspace/repo/package.json, enumerates every key of process.env and concatenates each key=value pair, and POSTs each of these payloads (prefixed GREP:, FILE:, ALLENV:) to the hardcoded attacker endpoint webhook.site/89bd8fe7-328c-4e6d-970c-4d567b5a48a0. The binding.gyp has no accompanying native source files; its only purpose is to run the embedded exfiltration command. The implausibly high version string (99999.0.1) is consistent with a dependency-confusion lure. Installing this package in a developer workstation or CI environment causes CI secrets, API tokens, and environment-injected credentials, along with workspace file contents and any file containing the HTB{ marker, to be transmitted to an attacker-controlled host.

Database specific 
{
    "malicious-packages-origins":  [
        {
            "id":  "IN-MAL-2026-022403",
            "import_time":  "2026-10-29T15:13:32.47962823Z",
            "modified_time":  "2026-10-29T14:53:44Z",
            "sha256":  "12d717b37056ccc36cc4225071d8a9ed6e39b269e207c3891b43476f15cf7978",
            "source":  "amazon-inspector",
            "versions":  [
                "99999.0.2"
            ]
        },
        {
            "id":  "IN-MAL-2026-022404",
            "import_time":  "2026-10-29T15:13:32.601181559Z",
            "modified_time":  "2026-10-29T14:53:54Z",
            "sha256":  "28b6b5c8c100680386dbcbbd51dd409f67f0d54701eb0e50232934acc53bf397",
            "source":  "amazon-inspector",
            "versions":  [
                "99999.0.1"
            ]
        },
        {
            "id":  "IN-MAL-2026-022402",
            "import_time":  "2026-10-29T15:13:32.360967203Z",
            "modified_time":  "2026-10-29T14:53:35Z",
            "sha256":  "a563521f86b861850e706bfc78b51306b4467284f14a7251f956f55c32067e0d",
            "source":  "amazon-inspector",
            "versions":  [
                "99999.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / @dmangal/curse-dependent-ecto

Package

Name
@dmangal/curse-dependent-ecto
View open source insights on deps.dev
Purl
pkg:npm/%40dmangal/curse-dependent-ecto

Affected ranges

Affected versions

99999.*
99999.0.0
99999.0.1
99999.0.2

Database specific

cwes 
[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files":  [
        {
            "path":  "binding.gyp",
            "sha256":  "e4d16932f4bfabf03b6d7a86813ea94410cef5b713281bf4c45a1e7827d7ff33",
            "tlsh":  "5b4151b8fa6d8615327b4528b93e24c0dc73ae53416068c6bf5c3e98af28444092bbb4"
        }
    ],
    "package_integrity":  [
        {
            "filename":  "curse-dependent-ecto-99999.0.2.tgz",
            "hashes":  {
                "sha1":  "bf6bf4eca71a0d161cadf07511b4cd2e4a38335a",
                "sha512_sri":  "sha512-gkXkRk8dTDOt/w7Qf9/LrQe/rgEcni9pJ3VOj6rccxUh9WyjA1T36p09eK7zFkhnnPHbIa/dmsnTKyE9esnvbw=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@dmangal/curse-dependent-ecto/MAL-2026-18375.json"