MalwarePublished 30 Jun 2026

ecto-corsair-flag-7kq3mz (npm) · Malicious Code

Affects ecto-corsair-flag-7kq3mzSource GCVE Database

Malicious package : remove ecto-corsair-flag-7kq3mz and rotate any secrets on hosts that installed it.

Data as of 30 Jun 2026, 23:39 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-6699

What to do

Remove ecto-corsair-flag-7kq3mz from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmecto-corsair-flag-7kq3mz	Affected =1.0.2 =1.0.0 =1.0.1	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package ecto-corsair-flag-7kq3mz (versions 1.0.0, 1.0.1, and 1.0.2) contains malicious code that executes during installation. Its postinstall.js script collects sensitive environment information and searches the filesystem for flag-like strings, then exfiltrates this data to an attacker-controlled server. The package also attempts to detect successful dependency confusion attacks. Installing this package results in unauthorized data exfiltration.

Impact

Installation of affected versions of this package results in unconsented exfiltration of potentially sensitive environment variables and filesystem contents to an attacker-controlled server. This compromises confidentiality of the host environment and any sensitive data present in searched directories. The malicious behavior occurs automatically during package installation without user consent.

Defensive guidance

Users should avoid installing the ecto-corsair-flag-7kq3mz package, especially versions 1.0.0, 1.0.1, and 1.0.2. Review and audit dependencies before installation to prevent supply chain compromise. Monitor for and remove this package if found in existing environments.

Summary

The ecto-corsair-flag-7kq3mz npm package uses lifecycle hooks (preinstall, install, postinstall) to run a postinstall.js script unconditionally on npm install. This script collects hostname, current working directory, user ID, and environment variables related to FLAG/CTF/NPM/REGISTRY/CI/GITHUB/RUNNER. It recursively searches directories such as /app, /workspace, /challenge, and others for strings resembling flags. The collected data is base64-encoded and sent via HTTP PUT to a remote IP address, with an additional GET request to a webhook URL. The package also checks npm_config_registry for signs of dependency confusion. Despite framing as a CTF probe, it performs unauthorized exfiltration of environment and filesystem data to an attacker-controlled endpoint.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 30 Jun 2026, 23:39 UTC

Technical details

References

Community reviews