MAL-2026-6242

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/atlasora-types/MAL-2026-6242.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-6242
Published
2026-06-20T13:10:05Z
Modified
2026-06-20T13:46:43.347797649Z
Summary
Malicious code in atlasora-types (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (7af2118f668c8e39caf15aeb52d365083d5bc6b9c1ae4d9ff6d007d348ba8b9e)

On npm install, the package runs install.js via the postinstall lifecycle hook. The script harvests installer-side secrets and POSTs them as JSON to a hardcoded attacker-controlled endpoint at https://webhook.site/22e20640-e2a1-4bb2-b203-061077d055ff (the variable is literally named EXFIL_SERVER at install.js:11). Collected data includes: a wide list of environment variables (AWS access keys, OpenAI/Anthropic API keys, Supabase, Coinbase, JWT secrets, database URLs); the contents of.env files in the current working directory and parent directories; every file in ~/.ssh whose contents contain 'PRIVATE' or 'KEY' (private SSH keys); ~/.aws/credentials; ~/.npmrc (including auth tokens); and git config. Host identity (os.hostname(), os.userInfo()) and command output via execSync are also gathered. The package additionally impersonates a different project: the install banner prints '@atlasora/shared: installed successfully' while the published name is atlasora-types, and index.js is a placeholder exporting only name/version — the package has no legitimate functionality, only the credential-stealing payload.

Database specific 
{
    "malicious-packages-origins": [
        {
            "sha256": "7af2118f668c8e39caf15aeb52d365083d5bc6b9c1ae4d9ff6d007d348ba8b9e",
            "source": "amazon-inspector",
            "modified_time": "2026-06-20T13:10:05Z",
            "id": "IN-MAL-2026-007097",
            "versions": [
                "1.0.0"
            ],
            "import_time": "2026-06-20T13:37:51.275020757Z"
        }
    ]
}
References
Credits

Affected packages

npm / atlasora-types

Package

Name
atlasora-types
View open source insights on deps.dev
Purl
pkg:npm/atlasora-types

Affected ranges

Affected versions

1.*
1.0.0

Database specific

cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/atlasora-types/MAL-2026-6242.json"
indicators 
{
    "evidence_files": [
        {
            "sha256": "5849f99b3c22a51b079d3d793718c0b48cde0e1c6ed7d7738edaf87e8e01eb88",
            "tlsh": "887175a180f6026056d33ae7e58f24252215f153be12eed43ddc12519f8a62c86f2bff",
            "path": "install.js"
        },
        {
            "sha256": "c8735788a9b28d818078a4e01e5f30037edab01cf0e1e9d43e695f7216d546b5",
            "tlsh": "2ae0e5746a21d8b35ac966ac8d61510576218a4bc4586c1c37c7206cc3ce6260dfe72d",
            "path": "package.json"
        }
    ],
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-b9R2cRh53wOD3ZL3bkESmyecb+nsGV25FbXKQODUCvATf48P2Z/ohjWU8QAgIfHehzik10R/w2B8KtMw74s7Jg==",
                "sha1": "fa07d64ddce062b9e0f6bdd7cbef477a020680ca"
            },
            "filename": "atlasora-types-1.0.0.tgz"
        }
    ]
}