MAL-2026-18376

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/black-spindle-2/MAL-2026-18376.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-18376
Published
2026-10-29T14:59:21Z
Modified
2026-10-29T15:30:05Z
Summary
Malicious code in black-spindle-2 (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (433228fbed18f3104fed4cd1bce59bc5a76b8ea061d18c8fc9516c92b6b26e90)

package.json declares a postinstall script that runs curl against the ephemeral host http://778e-181-63-25-28.ngrok-free.app over plain HTTP, embedding a shell command-substitution expression in the URL path. The script fires automatically on npm install, confirming installation on the installer's machine and providing a channel to exfiltrate host or environment values via the expanded shell expression. The shipped index.js is an empty stub, so the manifest's postinstall beacon is the package's entire effect. The destination is an anonymous ngrok-free.app tunnel with no relationship to any legitimate publisher, consistent with a dependency-confusion or install-confirmation probe.

Database specific 
{
    "malicious-packages-origins":  [
        {
            "id":  "IN-MAL-2026-022416",
            "import_time":  "2026-10-29T15:13:34.018067481Z",
            "modified_time":  "2026-10-29T14:59:21Z",
            "sha256":  "433228fbed18f3104fed4cd1bce59bc5a76b8ea061d18c8fc9516c92b6b26e90",
            "source":  "amazon-inspector",
            "versions":  [
                "301.0.0"
            ]
        },
        {
            "id":  "IN-MAL-2026-022417",
            "import_time":  "2026-10-29T15:13:34.16295529Z",
            "modified_time":  "2026-10-29T14:59:29Z",
            "sha256":  "f973afbbc02414b7152e990c158f7ede82cfc71a14c99ece0b714b57e50b2a55",
            "source":  "amazon-inspector",
            "versions":  [
                "100.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / black-spindle-2

Package

Name
black-spindle-2
View open source insights on deps.dev
Purl
pkg:npm/black-spindle-2

Affected ranges

Affected versions

100.*
100.0.0
301.*
301.0.0

Database specific

cwes 
[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files":  [
        {
            "path":  "package.json",
            "sha256":  "23ed0ca25321dfb43a5d9ced2e644ec77ddcd0396c531171048b4f0d1a8c0a66",
            "tlsh":  "7ac0226249a1066330a087bee4f686037a020a2f21b04a8db0b360180a510371b09b2a"
        }
    ],
    "package_integrity":  [
        {
            "filename":  "black-spindle-2-301.0.0.tgz",
            "hashes":  {
                "sha1":  "d760479febfaa0c100b132588019f47f8bb0ca49",
                "sha512_sri":  "sha512-6HOhR1bBUj0FmPR7tBnZHN7oontvG1KasNxMP3ryP/8pzdRTRvV94kvKktiwdQ/YO558WcZV3xrD1fJPwVPbdw=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/black-spindle-2/MAL-2026-18376.json"