MalwarePublished 9 Jul 2026

cursed-ecto-d3ab00 (npm) · Malicious Code

Affects cursed-ecto-d3ab00Source GCVE Database

Malicious package : remove cursed-ecto-d3ab00 and rotate any secrets on hosts that installed it.

Data as of 11 Jul 2026, 09:43 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-10061

What to do

Remove cursed-ecto-d3ab00 from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmcursed-ecto-d3ab00	Affected 1.0.0 – 2.0.1 4 affected builds	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (49348969de68b56d680a46f67f817053621fa41a5220d8cd0bc1da720e77a5a1) The package has no legitimate functionality (index.js is an empty module) and exists solely to run an install-time attack payload. All four lifecycle hooks (preinstall.js, install.js, postinstall.js, prepare.js) execute the same shell command via child_process.execSync that recursively scans host filesystem paths (/app, /opt, /root, /home, /srv, /data, /var, /etc, /tmp, /flag*, /) for HTB{...} flag patterns, enumerates flag-named files with their contents, captures env, hostname, id, and pwd, base64-encodes the collected data, and exfiltrates it via HTTPS GET to a hardcoded Cloudflare quick-tunnel endpoint at forward-amber-prairie-ruled.trycloudflare.com. In addition, each lifecycle script fans out HTTP PUT requests to internal hostnames and loopback ports (127.0.0.1:3000/8080/80/5000/4000 and hostnames app, web, frontend, console, ecto, registry, backend, nginx) targeting path /api/modules/ECT-839201 with a crafted ecto_module manifest named PWNED, attempting to register a malicious module on adjacent services reachable from the install environment. Behavior fires unconditionally on npm install. ## Source: ghsa-malware (1a2387faa45841f316d0f93fca1e870585406c9c61abfc59049c8bd2c117cb30) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Impact

Any system that installs this package is considered fully compromised. The attacker gains access to sensitive environment data, system identifiers, and potentially secrets stored on the host. The malicious code also attempts lateral movement by targeting internal services to register malicious modules, increasing the scope of compromise. Because the package runs code during installation, simply having it installed or running can lead to full system compromise. Secrets and keys on the affected system should be considered exposed and rotated immediately.

Defensive guidance

The package should be removed immediately if found installed. Systems that have installed this package should be treated as fully compromised; all secrets and keys must be rotated from a separate, trusted environment. Due to the nature of the compromise, full system reimaging or restoration from a known good backup is recommended. Avoid installing untrusted or suspicious npm packages, and verify package legitimacy before use.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 10 Jul 2026, 09:29 UTC

Technical details

References

Community reviews