MalwarePublished 29 Oct 2026

black-spindle-2 (npm) · Malicious Code

Affects black-spindle-2Source GCVE Database

Malicious package : remove black-spindle-2 and rotate any secrets on hosts that installed it.

Data as of 29 Oct 2026, 18:52 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-18376

What to do

Remove black-spindle-2 from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmblack-spindle-2	Affected =301.0.0 =100.0.0	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The black-spindle-2 npm package contains malicious code in its postinstall script. This script executes automatically upon installation and makes an HTTP request to an anonymous ngrok-free.app URL, embedding shell command substitution. This behavior can confirm installation on the host and potentially exfiltrate environment or host data. The package's main code is an empty stub, indicating the postinstall script is the primary malicious component.

Impact

The malicious postinstall script can confirm the package's installation on a host and exfiltrate sensitive environment or host information to an attacker-controlled server. This compromises confidentiality and may aid attackers in further targeting or reconnaissance. No direct code execution beyond the postinstall script is present, but the exfiltration channel poses a privacy and security risk.

Defensive guidance

Users should avoid installing the black-spindle-2 package versions 301.0.0 and 100.0.0. Remove any installations of this package and audit systems for any data exfiltration. Use trusted package sources and verify package integrity before installation.

Summary

The black-spindle-2 npm package declares a postinstall script in its package.json that runs a curl command against an ephemeral and anonymous ngrok-free.app host over plain HTTP. The URL path includes a shell command-substitution expression, which executes on the installer's machine during npm install. This script acts as an installation confirmation beacon and may exfiltrate host or environment information. The package's index.js file is an empty stub, indicating no legitimate functionality beyond the postinstall script. The destination host is unrelated to any legitimate publisher, consistent with dependency confusion or install confirmation probes.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 29 Oct 2026, 18:52 UTC

Technical details

References

Community reviews