MAL-2026-5779

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/hemi-supply-cron/MAL-2026-5779.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-5779
Published
2026-06-15T15:09:34Z
Modified
2026-07-23T07:51:37.803552455Z
Summary
Malicious code in hemi-supply-cron (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (c41be27601d38eb5c0b527a9ec22b7516734e8eae985a2607ae6d70878f5f1d9)

package.json declares a preinstall hook (node postinstall.js) that fires automatically on npm install. The script collects host identity (os.hostname(), os.userInfo().username, process.cwd()) and enumerates process.env, filtering keys against the regex /key|secret|token|pass|private|ssh|deploy|auth|api|rpc|wallet|sentry|docker|graph|slack|host/i to harvest any credential-shaped variables (AWS keys, SSH/deploy tokens, RPC/wallet secrets, API tokens, etc.). The collected JSON payload is HTTPS POSTed to the hardcoded bare IP 185.130.46.35:8443 at path /collect. The package has no library functionality — index.js exports an empty object — and is published at version 999.0.0, the canonical dependency-confusion shape used to override an internal package name with a higher public version. The package's sole purpose is to harvest installer/CI secrets.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-06-15T15:30:21.985585115Z",
            "source": "amazon-inspector",
            "modified_time": "2026-06-15T15:09:34Z",
            "sha256": "c41be27601d38eb5c0b527a9ec22b7516734e8eae985a2607ae6d70878f5f1d9",
            "id": "IN-MAL-2026-006486",
            "versions": [
                "999.0.0"
            ]
        },
        {
            "import_time": "2026-07-20T13:14:47.484940688Z",
            "source": "reversing-labs",
            "modified_time": "2026-07-20T10:46:08Z",
            "sha256": "0fe7117c9f4a8e62b325c7f04932fad18bded6a59b2b642a01723f049efacbee",
            "id": "RLMA-2026-05552",
            "versions": [
                "999.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / hemi-supply-cron

Package

Name
hemi-supply-cron
View open source insights on deps.dev
Purl
pkg:npm/hemi-supply-cron

Affected ranges

Affected versions

999.*
999.0.0

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/hemi-supply-cron/MAL-2026-5779.json"
indicators 
{
    "evidence_files": [
        {
            "sha256": "d64656e6553409a54557222ecca0d2d914ac89afab42f95780168653327962f3",
            "tlsh": "ef0141f884ed95a226e797d8f117901761bbd2323d0678b0baa842851fcc27485f2cf2",
            "path": "postinstall.js"
        },
        {
            "sha256": "40e334223e5575864b28d5c3b5c5f38992e1ffe22a985f335a17cfd7f73a5a98",
            "tlsh": "2bc01274cd1557731cc40ba595a2850975a11d2b6004a85857c3149442aa77658ab70d",
            "path": "package.json"
        }
    ],
    "package_integrity": [
        {
            "filename": "hemi-supply-cron-999.0.0.tgz",
            "hashes": {
                "sha1": "691a21e5381d0fdbcfe1f1991b236f7056ecddc3",
                "sha512_sri": "sha512-Pm9i/tW3FBO94QoX54K9ilVW4hG5gaWQLekKJ8wDxpacy8CVZNFmheLx/ANBY7XuAcG/KP3hetRTuL9XQZdVdw=="
            }
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]