Malicious code in coral-wraith (npm)
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (cf0e5e4aa66ffeb1481fd587c96f596a227c9388b86b3a3443749b5ec9eb09f1) The package's postinstall.js runs at install time and performs a credential-harvest + host-tampering chain against the installer. It enumerates npm credentials by calling `npm config get` for keys including `_authToken`, `_auth`, `registry`, `//registry.spectral-corsair.htb:1337/:_authToken`, `//registry.spectral-corsair.htb/:_authToken`, and `//154.57.164.64:32271/:_authToken`, dumps the full `npm config list --json`, and reads /usr/lib/node_modules/npm/.npmrc, /etc/hosts, /app/.bowerrc, /root/.bowerrc, and source files under /app (Cargo.toml, main.rs) plus filesystem-wide flag/secret greps. The collected output is base64-encoded and HTTP PUT to a hardcoded bare IP `http://154.57.164.64:32271/api/modules/...`. Separately, postinstall.js appends `154.57.164.64 registry.spectral-corsair.htb` to /etc/hosts when not already present, then queries the spoofed registry via curl and `npm view` — install-time host-file tampering that redirects a registry hostname to an attacker-controlled IP and enables later package substitution / MITM. Execution is gated by an anti-analysis `shouldRun()` that bypasses CI environments (GITHUB_ACTIONS, RUNNER_OS, CI), Chinese registry mirrors (npmmirror, tencent, cnpm, taobao), and /tmp working dirs, and only fires when the hostname matches a 12-hex Docker short-id pattern and cwd contains `/app` — narrow targeting that confirms intent while shipping the malicious code unconditionally. ## Source: ghsa-malware (38185d2c242e73e720a6be3f2b234a23119ec986c4b7ca57ca789e24616c1029) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it. ## Source: ossf-package-analysis (f10fa9dc8c51419efaef960da0e4bed5e80346be9279a40d610d695a8571f6b7) The OpenSSF Package Analysis project identified 'coral-wraith' @ 6.0.0 (npm) as malicious. It is considered malicious because: - The package executes one or more commands associated with malicious behavior.
AI Analysis
Technical Summary
The 'coral-wraith' npm package versions including 1.0.0 through 22.0.0 (specific versions enumerated) contain a postinstall.js script that executes at install time to perform credential harvesting and host tampering. It enumerates npm credentials by querying npm config keys and reading configuration files, then base64-encodes and exfiltrates this data via HTTP PUT to a hardcoded IP address. Additionally, it modifies the /etc/hosts file to redirect a registry hostname to an attacker-controlled IP, facilitating later package substitution or man-in-the-middle attacks. Execution is conditionally gated to avoid CI environments, Chinese mirrors, and non-targeted directories, focusing on Docker container environments with specific hostname patterns. This behavior indicates deliberate malicious intent embedded in the package code. The OpenSSF Package Analysis and Amazon Inspector sources confirm the package as malicious and advise treating any system with this package installed as fully compromised.
Potential Impact
Systems with any affected version of the 'coral-wraith' package installed or running are fully compromised. Attackers gain access to npm credentials and potentially other sensitive files on the host. Host file tampering enables redirection of package registry requests to attacker-controlled servers, increasing risk of further supply chain attacks. Secret and key exposure requires immediate rotation from a secure environment. Removal of the package alone does not guarantee full remediation due to possible persistent backdoors or additional malware installed by the package.
Mitigation Recommendations
No official patch or fix is available for this malicious package. The recommended mitigation is to immediately remove all affected versions of 'coral-wraith' from all systems. All secrets, credentials, and keys stored on compromised hosts must be rotated immediately from a secure, uncompromised environment. Due to the high risk of full system compromise, consider rebuilding affected systems from known good backups or reinstalling operating systems to ensure complete removal of malicious artifacts. Monitor for any signs of persistence or further compromise.
Malicious code in coral-wraith (npm)
Description
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (cf0e5e4aa66ffeb1481fd587c96f596a227c9388b86b3a3443749b5ec9eb09f1) The package's postinstall.js runs at install time and performs a credential-harvest + host-tampering chain against the installer. It enumerates npm credentials by calling `npm config get` for keys including `_authToken`, `_auth`, `registry`, `//registry.spectral-corsair.htb:1337/:_authToken`, `//registry.spectral-corsair.htb/:_authToken`, and `//154.57.164.64:32271/:_authToken`, dumps the full `npm config list --json`, and reads /usr/lib/node_modules/npm/.npmrc, /etc/hosts, /app/.bowerrc, /root/.bowerrc, and source files under /app (Cargo.toml, main.rs) plus filesystem-wide flag/secret greps. The collected output is base64-encoded and HTTP PUT to a hardcoded bare IP `http://154.57.164.64:32271/api/modules/...`. Separately, postinstall.js appends `154.57.164.64 registry.spectral-corsair.htb` to /etc/hosts when not already present, then queries the spoofed registry via curl and `npm view` — install-time host-file tampering that redirects a registry hostname to an attacker-controlled IP and enables later package substitution / MITM. Execution is gated by an anti-analysis `shouldRun()` that bypasses CI environments (GITHUB_ACTIONS, RUNNER_OS, CI), Chinese registry mirrors (npmmirror, tencent, cnpm, taobao), and /tmp working dirs, and only fires when the hostname matches a 12-hex Docker short-id pattern and cwd contains `/app` — narrow targeting that confirms intent while shipping the malicious code unconditionally. ## Source: ghsa-malware (38185d2c242e73e720a6be3f2b234a23119ec986c4b7ca57ca789e24616c1029) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it. ## Source: ossf-package-analysis (f10fa9dc8c51419efaef960da0e4bed5e80346be9279a40d610d695a8571f6b7) The OpenSSF Package Analysis project identified 'coral-wraith' @ 6.0.0 (npm) as malicious. It is considered malicious because: - The package executes one or more commands associated with malicious behavior.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The 'coral-wraith' npm package versions including 1.0.0 through 22.0.0 (specific versions enumerated) contain a postinstall.js script that executes at install time to perform credential harvesting and host tampering. It enumerates npm credentials by querying npm config keys and reading configuration files, then base64-encodes and exfiltrates this data via HTTP PUT to a hardcoded IP address. Additionally, it modifies the /etc/hosts file to redirect a registry hostname to an attacker-controlled IP, facilitating later package substitution or man-in-the-middle attacks. Execution is conditionally gated to avoid CI environments, Chinese mirrors, and non-targeted directories, focusing on Docker container environments with specific hostname patterns. This behavior indicates deliberate malicious intent embedded in the package code. The OpenSSF Package Analysis and Amazon Inspector sources confirm the package as malicious and advise treating any system with this package installed as fully compromised.
Potential Impact
Systems with any affected version of the 'coral-wraith' package installed or running are fully compromised. Attackers gain access to npm credentials and potentially other sensitive files on the host. Host file tampering enables redirection of package registry requests to attacker-controlled servers, increasing risk of further supply chain attacks. Secret and key exposure requires immediate rotation from a secure environment. Removal of the package alone does not guarantee full remediation due to possible persistent backdoors or additional malware installed by the package.
Mitigation Recommendations
No official patch or fix is available for this malicious package. The recommended mitigation is to immediately remove all affected versions of 'coral-wraith' from all systems. All secrets, credentials, and keys stored on compromised hosts must be rotated immediately from a secure, uncompromised environment. Due to the high risk of full system compromise, consider rebuilding affected systems from known good backups or reinstalling operating systems to ensure complete removal of malicious artifacts. Monitor for any signs of persistence or further compromise.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-5682
- Osv Schema Version
- 1.7.4
- Aliases
- ["GHSA-f2r7-23p9-8jff"]
- Ecosystems
- ["npm"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a4f6c4168715ace43158b72
Added to database: 07/09/2026, 09:39:13 UTC
Last enriched: 07/09/2026, 09:55:00 UTC
Last updated: 07/30/2026, 14:00:05 UTC
Views: 8
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.