MAL-2026-18377

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/spectral-core/MAL-2026-18377.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-18377
Published
2026-10-29T14:57:43Z
Modified
2026-10-29T15:30:06Z
Summary
Malicious code in spectral-core (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (451c36f03e81be0ff6c85334587d7ff401de1e5134e179557ec4bc454cd7ba76)

The tarball ships only package.json and binding.gyp (plus a markdown file), with gypfile: true set in package.json so npm invokes node-gyp rebuild on install. binding.gyp declares a 'none'-type target with no native source files; its sole purpose is an inline action that runs node -e with an embedded script. At install time that script reads /proc/1/environ and /proc/self/environ (container/pod entrypoint environment variables, which routinely contain CI/CD secrets and cloud credentials), collects DNS/socket/ARP/route reconnaissance output, queries the AWS EC2 instance metadata service at 169.254.169.254 for user-data and meta-data, and POSTs the collected data to the hardcoded collector https://webhook.site/d6092bdc-05c0-45da-a280-c343ea6d6156. The package exposes no library functionality — main: index.js is declared but index.js is not shipped — so the binding.gyp exists solely as a vehicle for install-time code execution and credential exfiltration. The name resembles the legitimate @stoplight/spectral-core project but the shipped contents are unrelated to it.

Database specific 
{
    "malicious-packages-origins":  [
        {
            "id":  "IN-MAL-2026-022409",
            "import_time":  "2026-10-29T15:13:33.239756316Z",
            "modified_time":  "2026-10-29T14:58:15Z",
            "sha256":  "451c36f03e81be0ff6c85334587d7ff401de1e5134e179557ec4bc454cd7ba76",
            "source":  "amazon-inspector",
            "versions":  [
                "3.0.6"
            ]
        },
        {
            "id":  "IN-MAL-2026-022413",
            "import_time":  "2026-10-29T15:13:33.67013451Z",
            "modified_time":  "2026-10-29T14:58:46Z",
            "sha256":  "54cb50bba7e6f19319df8f23816710ec57a29dc6d69025f3b9c5ddf71f01325c",
            "source":  "amazon-inspector",
            "versions":  [
                "3.0.4"
            ]
        },
        {
            "id":  "IN-MAL-2026-022407",
            "import_time":  "2026-10-29T15:13:32.968949059Z",
            "modified_time":  "2026-10-29T14:58:00Z",
            "sha256":  "79c6086910623ed4eed9f7bb0f1305df0cacd70ab45112d52a295b47a9d9eb5a",
            "source":  "amazon-inspector",
            "versions":  [
                "3.0.10"
            ]
        },
        {
            "id":  "IN-MAL-2026-022411",
            "import_time":  "2026-10-29T15:13:33.465182254Z",
            "modified_time":  "2026-10-29T14:58:31Z",
            "sha256":  "8b8de448b1a3fae15b672af020951d2cc5556f943bb2a302f4ccb23ffde8aaa1",
            "source":  "amazon-inspector",
            "versions":  [
                "3.0.5"
            ]
        },
        {
            "id":  "IN-MAL-2026-022415",
            "import_time":  "2026-10-29T15:13:33.899623308Z",
            "modified_time":  "2026-10-29T14:59:12Z",
            "sha256":  "baeee5e622f864693e676d6fc1c780c842218a5b7a6d06bedce5d732ea40629a",
            "source":  "amazon-inspector",
            "versions":  [
                "3.0.3"
            ]
        },
        {
            "id":  "IN-MAL-2026-022406",
            "import_time":  "2026-10-29T15:13:32.87266895Z",
            "modified_time":  "2026-10-29T14:57:51Z",
            "sha256":  "cd35974c3234a6dad4309c3401da17d4fbf5fbf8465bd4f351be966f9500aa09",
            "source":  "amazon-inspector",
            "versions":  [
                "3.0.11"
            ]
        },
        {
            "id":  "IN-MAL-2026-022408",
            "import_time":  "2026-10-29T15:13:33.08671578Z",
            "modified_time":  "2026-10-29T14:58:07Z",
            "sha256":  "de6a163084b23d2a75e3512f9cbe77045ba53182d1e08752c00a0d886e2cd62f",
            "source":  "amazon-inspector",
            "versions":  [
                "3.0.7"
            ]
        },
        {
            "id":  "IN-MAL-2026-022412",
            "import_time":  "2026-10-29T15:13:33.566689005Z",
            "modified_time":  "2026-10-29T14:58:39Z",
            "sha256":  "e06fe8f5e55d720c49a2919236fdc93fd33d62a937078c83060ee251bae4cbe4",
            "source":  "amazon-inspector",
            "versions":  [
                "3.0.12"
            ]
        },
        {
            "id":  "IN-MAL-2026-022405",
            "import_time":  "2026-10-29T15:13:32.733484061Z",
            "modified_time":  "2026-10-29T14:57:43Z",
            "sha256":  "fdc14a289befd2f77d2b9d8084d7a8f1db9a8de799407a2f12b338d4101d0272",
            "source":  "amazon-inspector",
            "versions":  [
                "3.0.9"
            ]
        },
        {
            "id":  "IN-MAL-2026-022410",
            "import_time":  "2026-10-29T15:13:33.366659328Z",
            "modified_time":  "2026-10-29T14:58:25Z",
            "sha256":  "d87e383d290979921fc31446bf3aa12ceb70744065334b1ea0eeda11dd4c979f",
            "source":  "amazon-inspector",
            "versions":  [
                "3.0.2"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / spectral-core

Package

Name
spectral-core
View open source insights on deps.dev
Purl
pkg:npm/spectral-core

Affected ranges

Affected versions

3.*
3.0.2
3.0.3
3.0.4
3.0.5
3.0.6
3.0.7
3.0.9
3.0.10
3.0.11
3.0.12

Database specific

cwes 
[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files":  [
        {
            "path":  "binding.gyp",
            "sha256":  "0f314f2559c6a7efcdb2e539d598afd3f3042b9652ce30bd58fddfd60bfa454c",
            "tlsh":  "d7314098b7748abb56d0461dd6ae8703c133a16286c07ec4b7ec6ded1f0e4411a34ef1"
        }
    ],
    "package_integrity":  [
        {
            "filename":  "spectral-core-3.0.6.tgz",
            "hashes":  {
                "sha1":  "cc4e240b34a543c4945e216757e0ecc65198df1c",
                "sha512_sri":  "sha512-N+bFcMCDAZSFlzi2Xho05OzcUlrQpcM7hJXF+OpyCT0kuVCBdpUtxMz6nUMIJtJnfClvugdxaBfhUC2E2bO6Sw=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/spectral-core/MAL-2026-18377.json"