Malicious code in carbon-monorepo (npm)
The carbon-monorepo npm package version 20.1.1 contains malicious code that executes during installation. It runs a postinstall script that collects extensive host information and sensitive data, including environment variables, system details, user information, and npm authentication tokens. This data is exfiltrated over plain HTTP to a hardcoded external server. The package masquerades as a legitimate esbuild build artifact but only delivers the malicious payload during installation.
AI Analysis
Technical Summary
The carbon-monorepo npm package version 20.1.1 includes a postinstall hook that executes index.js upon installation. This script performs host reconnaissance by gathering os.hostname(), full process environment variables, platform and architecture details, current working directory, package.json contents, node_modules listing, and outputs of commands such as whoami, uname, id, and contents of /etc/passwd and /etc/shadow. It also reads the ~/.npmrc file, which often contains npm authentication tokens, and recent npm logs. All collected data is sent via an unencrypted HTTP POST request to a hardcoded Burp Collaborator subdomain (ywy8qnd4a931ga4v74k70b9g67c00qof.oastify.com). The package metadata falsely claims to be a netbsd-x64 build for esbuild, but no actual build artifacts or library code are included, only the malicious exfiltration script.
Potential Impact
Sensitive host and user data, including environment variables, system information, user identity, and npm authentication tokens, can be exfiltrated to an attacker-controlled server during package installation. This can lead to credential theft, unauthorized access, and further compromise of the development environment or deployment pipelines.
Mitigation Recommendations
No official patch or remediation is currently documented. Users should avoid installing version 20.1.1 of the carbon-monorepo package. Verify package integrity and source before installation. Monitor for suspicious network activity related to npm installs. Check vendor advisories or trusted security sources for updates or fixes regarding this package.
Malicious code in carbon-monorepo (npm)
Description
The carbon-monorepo npm package version 20.1.1 contains malicious code that executes during installation. It runs a postinstall script that collects extensive host information and sensitive data, including environment variables, system details, user information, and npm authentication tokens. This data is exfiltrated over plain HTTP to a hardcoded external server. The package masquerades as a legitimate esbuild build artifact but only delivers the malicious payload during installation.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The carbon-monorepo npm package version 20.1.1 includes a postinstall hook that executes index.js upon installation. This script performs host reconnaissance by gathering os.hostname(), full process environment variables, platform and architecture details, current working directory, package.json contents, node_modules listing, and outputs of commands such as whoami, uname, id, and contents of /etc/passwd and /etc/shadow. It also reads the ~/.npmrc file, which often contains npm authentication tokens, and recent npm logs. All collected data is sent via an unencrypted HTTP POST request to a hardcoded Burp Collaborator subdomain (ywy8qnd4a931ga4v74k70b9g67c00qof.oastify.com). The package metadata falsely claims to be a netbsd-x64 build for esbuild, but no actual build artifacts or library code are included, only the malicious exfiltration script.
Potential Impact
Sensitive host and user data, including environment variables, system information, user identity, and npm authentication tokens, can be exfiltrated to an attacker-controlled server during package installation. This can lead to credential theft, unauthorized access, and further compromise of the development environment or deployment pipelines.
Mitigation Recommendations
No official patch or remediation is currently documented. Users should avoid installing version 20.1.1 of the carbon-monorepo package. Verify package integrity and source before installation. Monitor for suspicious network activity related to npm installs. Check vendor advisories or trusted security sources for updates or fixes regarding this package.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-14229
- Osv Schema Version
- 1.7.4
- Aliases
- []
- Ecosystems
- ["npm"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a85b4c2acd9273b492524f1
Added to database: 08/19/2026, 13:50:58 UTC
Last enriched: 08/19/2026, 14:33:02 UTC
Last updated: 08/19/2026, 23:07:02 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.