MAL-2026-5981

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/metrics-probe-64b2/MAL-2026-5981.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-5981
Aliases
  • GHSA-7jwq-33cp-frr8
Published
2026-06-17T04:43:39Z
Modified
2026-06-18T06:01:52.407847222Z
Summary
Malicious code in metrics-probe-64b2 (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (cae901b673ee21724897f69c782eb2808c55c2722bacc9912a4a3e60f7019883)

package.json declares a postinstall hook ("postinstall": "node run.js") that executes run.js automatically on every npm install. run.js imports os, fs, http, https, and child_process, reads host identifiers including os.hostname() and os.platform(), reads files from disk via fs.readFileSync, and issues outbound HTTP POST requests carrying that data. The package's stated name ("metrics-probe") with a random hex suffix, combined with an install-time host-fingerprinting beacon and no library functionality, matches the shape of an installer-side reconnaissance / data-exfiltration payload that fires automatically on npm install without any user action.

Source: ghsa-malware (e74624577c3b03a5250f5be13a89c3ba4495967d8389dbd384525e72c15c2bb0)

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Database specific 
{
    "malicious-packages-origins": [
        {
            "versions": [
                "1.0.0"
            ],
            "id": "IN-MAL-2026-006903",
            "import_time": "2026-06-17T05:45:43.436678696Z",
            "modified_time": "2026-06-17T04:43:39Z",
            "sha256": "cae901b673ee21724897f69c782eb2808c55c2722bacc9912a4a3e60f7019883",
            "source": "amazon-inspector"
        },
        {
            "sha256": "e74624577c3b03a5250f5be13a89c3ba4495967d8389dbd384525e72c15c2bb0",
            "id": "GHSA-7jwq-33cp-frr8",
            "import_time": "2026-06-18T05:54:18.950971011Z",
            "modified_time": "2026-06-18T03:27:56Z",
            "ranges": [
                {
                    "events": [
                        {
                            "introduced": "0"
                        }
                    ],
                    "type": "SEMVER"
                }
            ],
            "source": "ghsa-malware"
        }
    ]
}
References
Credits

Affected packages

npm / metrics-probe-64b2

Package

Name
metrics-probe-64b2
View open source insights on deps.dev
Purl
pkg:npm/metrics-probe-64b2

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

1.*
1.0.0

Database specific

indicators 
{
    "package_integrity": [
        {
            "filename": "metrics-probe-64b2-1.0.0.tgz",
            "hashes": {
                "sha512_sri": "sha512-dFEyLdnMOdjFB+7NIEJddYO+Dr91b+Dnu4yy/Wok0ExOIJcDGT1iMAI3u1hEiD6hmt/d9G5N112w0yUrCjSo0g==",
                "sha1": "05da68666682b5f54ac1c79cb43131de84422dd1"
            }
        }
    ],
    "evidence_files": [
        {
            "sha256": "517355c5fb8b2974eaff6eda9f8496683d0faa96775112a5bd6312903fcf19e9",
            "tlsh": "1fe02b189c20393365c41aa90c919257a6304f1b2014391c53772428429bb79747b11d",
            "path": "package.json"
        },
        {
            "tlsh": "7762f87619f74a2439a3ea9d971fa4016423f1077a51eda0f28c72200fcf528d1b2ef8",
            "sha256": "8f47628c7cee00cb7f15df58acb59752085d8cc79735cf65dc51e3c6d57d8b1b",
            "path": "run.js"
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/metrics-probe-64b2/MAL-2026-5981.json"