MAL-2026-7016

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@vraksha/gh-helper/MAL-2026-7016.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-7016
Published
2026-07-08T18:08:50Z
Modified
2026-07-08T18:46:45.783463042Z
Summary
Malicious code in @vraksha/gh-helper (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (8c867b4c68acc159dea1bbd580c5de3f3c9fef7bd1f54cd48a02c59631ffda12)

On npm install, the package's postinstall hook runs index.js, which performs an HTTPS GET to https://http-logger-production.up.railway.app/payload, base64-decodes the response body (Buffer.from(data.trim(), 'base64').toString('utf-8')), and passes the decoded string to child_process.execSync with { shell: '/bin/bash' }. This is a fetch-decode-exec dropper: the executed content is attacker-controlled, mutable, and opaque, and it runs automatically at install time with the installer's privileges. No legitimate purpose (no shipped native source requiring a build, no vendor-matched SDK, no pinned artifact) justifies this pattern.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-008175",
            "import_time": "2026-07-08T18:34:24.572459158Z",
            "sha256": "8c867b4c68acc159dea1bbd580c5de3f3c9fef7bd1f54cd48a02c59631ffda12",
            "versions": [
                "1.0.0"
            ],
            "source": "amazon-inspector",
            "modified_time": "2026-07-08T18:08:50Z"
        }
    ]
}
References
Credits

Affected packages

npm / @vraksha/gh-helper

Package

Name
@vraksha/gh-helper
View open source insights on deps.dev
Purl
pkg:npm/%40vraksha/gh-helper

Affected ranges

Affected versions

1.*
1.0.0

Database specific

cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "index.js",
            "tlsh": "0df005f4e6b862744b7298c82547ec5af543a02237c5fb9275dc10469f855f022fa3e8",
            "sha256": "943a5d8635002550096aa6c0fe76ed06316388485c13b2208a4c2676a5a660da"
        }
    ],
    "package_integrity": [
        {
            "filename": "gh-helper-1.0.0.tgz",
            "hashes": {
                "sha1": "f0b239079119267338eee4972294a88d3c8497c6",
                "sha512_sri": "sha512-Gq74eZy7JVVsMKWgk7prFUIdmjKxdvEyuVtnLQk1DVI/GMnqVzkYYHh9XIjNozfZW+ohmzk5sSKe0bSRklOaoA=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@vraksha/gh-helper/MAL-2026-7016.json"