cr-bot-common (npm) · Malicious Code
Affects cr-bot-commonSource GCVE Database
Malicious package : remove cr-bot-common and rotate any secrets on hosts that installed it.
Data as of 14 Sep 2026, 00:46 UTC
Malicious package
Published to npm · OSV MAL-2026-16137
What to do
Remove cr-bot-common from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| npmcr-bot-common | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (ddd83408820ca65c51cea223a061260109332ba408ca3a43ba00ef827f1ad74f) preinstall.js and postinstall.js execute automatically on npm install. preinstall.js reads.env files from the current and parent directories, walks the working directory and home directory for files matching *.key, *.pem, id_rsa, id_ed25519, wallet.json, keystore.json, and mnemonic.txt, collects process.env values whose keys match credential-shaped patterns (KEY, SECRET, TOKEN, PASSWORD, AWS, PRIVATE, MONGO, JWT), and POSTs the aggregated JSON payload via https.request to https://attacker.com/collect. postinstall.js additionally captures hostname, user, uid/gid, cloud/container context (Docker, Kubernetes, AWS, GCP, Azure), and reads file contents from /root, /home, and /opt matching key/pem/mnemonic/wallet/keystore/secret, then POSTs to https://attacker.com/exfiltrate. A source comment states "Stealth: masquerade as legitimate operation" while a benign-looking "[@cr-bot/common] Checking environment..." message is printed and network errors are silently swallowed.