MAL-2026-6222

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/create-mono-package/MAL-2026-6222.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-6222
Published
2026-06-19T15:30:59Z
Modified
2026-06-19T15:47:26.800549645Z
Summary
Malicious code in create-mono-package (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (85402ef2db7bfd9e2bb01034a533e52649cf6058cc1e824e9c273aee5ae8121d)

The package's postinstall hook (.prepare.cjs) collects host fingerprint data (os.hostname(), os.userInfo().username, platform/arch, all non-internal network interface IPs, npm registry) plus a full dump of process.env (only keys prefixed with npm_lifecycle are filtered out) and HTTPS-POSTs the JSON payload to open.larksuite.com. Both the destination host and URL path are obfuscated: the hostname is built from a reversed charcode array with a -7 offset (_hostDecoder), and the path is XOR-decoded against key Zk9x (_pathDecoder). The send is wrapped in extensive sandbox/honeypot evasion — the script silently process.exit(0)s when env keys match analysis-pipeline prefixes (SANDYCLAW_, OPENCLAW_, PERMISO_, CHAINRADAR_, PYPIPOISON, ASPECTTLOG, THREATANALYZERMODEL) or when hostname/username matches patterns like detonat/cuckoo/virus/scan, and dummy values for GITHUBTOKEN/NPMTOKEN/AWSACCESSKEYID/AWSSECRETACCESS_KEY are explicitly skipped to avoid honeypots. On a real developer or CI machine, npm install create-mono-package ships every credential present in the environment (GitHub PATs, npm publish tokens, AWS keys, CI secrets, DB URIs) to the attacker-controlled Lark endpoint.

Database specific 
{
    "malicious-packages-origins": [
        {
            "sha256": "85402ef2db7bfd9e2bb01034a533e52649cf6058cc1e824e9c273aee5ae8121d",
            "source": "amazon-inspector",
            "modified_time": "2026-06-19T15:30:59Z",
            "versions": [
                "0.0.0"
            ],
            "id": "IN-MAL-2026-007081",
            "import_time": "2026-06-19T15:41:55.80642884Z"
        }
    ]
}
References
Credits

Affected packages

npm / create-mono-package

Package

Name
create-mono-package
View open source insights on deps.dev
Purl
pkg:npm/create-mono-package

Affected ranges

Affected versions

0.*
0.0.0

Database specific

cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/create-mono-package/MAL-2026-6222.json"
indicators 
{
    "evidence_files": [
        {
            "sha256": "d17157828b17732d1577bf74528962b924d57f28f238f5df8fe3c31411ae84a4",
            "tlsh": "ade131ced3a11ae5ab5108a3841e750a58b8c1231d2d92d8bcd4c2d77ff5b7056aa3fc",
            "path": ".prepare.cjs"
        }
    ],
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-wG7RylPjfCaEH18jgpZVo8n2NNo1az3itMLXNQ9iEfFzewIaTPn1rPEfh95fuJPbDf7BVsjZ6N1tIoEQXl1Fkg==",
                "sha1": "f133c5573aa364b7984148fef58c2644be9a0a71"
            },
            "filename": "create-mono-package-0.0.0.tgz"
        }
    ]
}