MAL-2026-4551

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/encrata-cli/MAL-2026-4551.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-4551
Published
2026-05-20T12:36:31Z
Modified
2026-05-26T06:02:29Z
Summary
Malicious code in encrata-cli (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (e98813f52fa8e9fc3c04bffd023445dbfed4a9b405d1e3f85511673f5e86dce7)

package.json declares "postinstall": "node install.js", which runs at install time. install.js requires both child_process and https, branches on process.platform to enumerate host details, and issues an outbound https.get(...) carrying the collected data. This is the canonical install-time system-information exfiltration shape: child_process to spawn host-info commands, platform-gated logic to pick the right binary per OS, and HTTPS egress to ship the result. There is no legitimate reason for a CLI's postinstall to gather host metadata and POST/GET it off-host. Installing this package on any machine (developer laptop, CI runner, build server) discloses host details to a remote endpoint and provides an install-time code-execution surface.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-004147",
            "import_time": "2026-05-26T05:52:01.666435355Z",
            "modified_time": "2026-05-22T06:16:26Z",
            "sha256": "80b70f02e409ec9eb28e4ddcdf37d477f4ffe774ff0a4026f0e242dcc0a1ef48",
            "source": "amazon-inspector",
            "versions": [
                "0.2.0"
            ]
        },
        {
            "id": "IN-MAL-2026-004146",
            "import_time": "2026-05-26T05:52:01.559120786Z",
            "modified_time": "2026-05-22T06:16:26Z",
            "sha256": "8a7070dd3d284cb91d046f6be633445a29af8e30a4fc0d3c77dce18bf847c0b0",
            "source": "amazon-inspector",
            "versions": [
                "0.2.0"
            ]
        },
        {
            "id": "IN-MAL-2026-003529",
            "import_time": "2026-05-26T05:50:48.039101961Z",
            "modified_time": "2026-05-20T12:36:32Z",
            "sha256": "b4eea8e53244b7114760ece8c8842f1936baca2e93ba8f49c76f7d02e7f0ffb6",
            "source": "amazon-inspector",
            "versions": [
                "0.1.0"
            ]
        },
        {
            "id": "IN-MAL-2026-003528",
            "import_time": "2026-05-26T05:50:47.903193915Z",
            "modified_time": "2026-05-20T12:36:31Z",
            "sha256": "e98813f52fa8e9fc3c04bffd023445dbfed4a9b405d1e3f85511673f5e86dce7",
            "source": "amazon-inspector",
            "versions": [
                "0.1.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / encrata-cli

Package

Name
encrata-cli
View open source insights on deps.dev
Purl
pkg:npm/encrata-cli

Affected ranges

Affected versions

0.*
0.1.0
0.2.0

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "domains": [
        "github.com"
    ],
    "evidence_files": [
        {
            "path": "install.js",
            "sha256": "c86aeb8a58c9f21a7e7a27d663f9edb009d7bffaa482c8034d0e91bc23adb8f5",
            "tlsh": "8551950d97e252305eb052e7b98b1c17e49b02237706cd88f2ac46183ff6d6495a63eb"
        },
        {
            "path": "package.json",
            "sha256": "3050a2eaa30e1acece5878910cbd1e84b6ab2a389afee13a3ea36e411985941e",
            "tlsh": "5e0199288e3109133bd895a81d99240a7523190b0cc47c263baf003d17ce23a207e2fe"
        }
    ],
    "package_integrity": [
        {
            "filename": "encrata-cli-0.2.0.tgz",
            "hashes": {
                "sha1": "90d211a7c3dc95b23f4a17bd7753e6331bf4cf90",
                "sha512_sri": "sha512-gQwz1rVjTnIh7tySZb1kMHDuCyxsVZyH2I7DSMXDw596Ko7YNtm0r1e8U7RiSXiI7c6geggXwgorVzDhzxDYFw=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/encrata-cli/MAL-2026-4551.json"