MAL-2026-5641

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/goreleaser-run/MAL-2026-5641.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-5641
Published
2026-06-11T12:53:24Z
Modified
2026-06-11T13:46:36.155321192Z
Summary
Malicious code in goreleaser-run (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (f2733e0c086915d44eb8c971575087d9260bf1133d62da63920b578cf7e60c30)

Package impersonates the legitimate goreleaser tool (name goreleaser-run, homepage spoofed to https://goreleaser.org; goreleaser is not officially published on npm). On every CLI invocation, bin/goreleaser.js downloads the real goreleaser binary as cover, then performs a multi-source credential harvest: it enumerates the entire process.env (Object.entries(process.env).forEach(([k,v]) => lines.push(...))), reads /etc/machine-id, os.hostname(), and GeoIP, walks two levels deep through all dotfiles under os.homedir() via discoverConfigs(...) and reads full file contents (capturing ~/.aws/credentials, ~/.ssh/id_*, ~/.npmrc, ~/.docker/config.json, ~/.netrc, ~/.gitconfig, ~/.git-credentials), and reads GITHUB_ENV / GITHUB_EVENT_PATH (which on GitHub Actions contain the full event payload and CI secrets). The collected body is POSTed via https.request to a hardcoded endpoint whose host and path are assembled with ['goreleaser','org'].join('.') and ['','static','preflight'].join('/') to evade static URL scanners. Comments frame the behavior as 'Pro license seat tracking' as a cover story. This is a textbook CI-credential harvester combining typosquat, obfuscation, and exfiltration of canonical installer-secret paths.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-06-11T13:27:20.372525322Z",
            "id": "IN-MAL-2026-005726",
            "versions": [
                "2.16.0"
            ],
            "source": "amazon-inspector",
            "modified_time": "2026-06-11T12:53:30Z",
            "sha256": "29d2b4defcfa634ab03d09bec1c45029b076c8207a005045c9dd9e0403c28676"
        },
        {
            "import_time": "2026-06-11T13:27:20.306581537Z",
            "id": "IN-MAL-2026-005724",
            "versions": [
                "2.16.1"
            ],
            "source": "amazon-inspector",
            "modified_time": "2026-06-11T12:53:24Z",
            "sha256": "f2733e0c086915d44eb8c971575087d9260bf1133d62da63920b578cf7e60c30"
        },
        {
            "import_time": "2026-06-11T13:27:20.338945716Z",
            "id": "IN-MAL-2026-005725",
            "versions": [
                "2.16.0"
            ],
            "source": "amazon-inspector",
            "modified_time": "2026-06-11T12:53:30Z",
            "sha256": "f468f4f36c9f478aa46b29663c987f313d882fa829061b9765cdf24e511a5e72"
        }
    ]
}
References
Credits

Affected packages

npm / goreleaser-run

Package

Name
goreleaser-run
View open source insights on deps.dev
Purl
pkg:npm/goreleaser-run

Affected ranges

Affected versions

2.*
2.16.0
2.16.1

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/goreleaser-run/MAL-2026-5641.json"
indicators 
{
    "evidence_files": [
        {
            "path": "bin/goreleaser.js",
            "tlsh": "edc184b653a6923a3b72c29fd306a016b257f1177205ed68b99cb10a1fce13441f39f5",
            "sha256": "7408b09cf2f23512f20a5012ef156865119858181f3ad970db0cd4c8ed265025"
        },
        {
            "path": "package.json",
            "tlsh": "8be07261f5005c3b04cc4643cc0262042928cd0b1b41fa3c374b810ccb9e0bb30f70ac",
            "sha256": "9793c3f0412157677f428102959cfbd2910c8b8466431339de8938f14164b62d"
        }
    ],
    "domains": [
        "ip-api.com",
        "goreleaser.org"
    ],
    "package_integrity": [
        {
            "filename": "goreleaser-run-2.16.1.tgz",
            "hashes": {
                "sha512_sri": "sha512-YUgrqHpEoxaZB9wM8M2Xs0jbtPgsC4bsJKJ6oXlHCF1L1lvo1RA3ybVzcGd9QhCatLcmphASPHhIUtuBgFzEsg==",
                "sha1": "1cf32ef5dad0fe3f1bf45f161a55ac7ffdc739e6"
            }
        }
    ]
}
cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    }
]