MalwarePublished 11 Jun 2026Updated 9 Jul 2026

ecto-corsair-whisper-6f3b9 (npm) · Malicious Code

Affects ecto-corsair-whisper-6f3b9Source GCVE Database

Malicious package : remove ecto-corsair-whisper-6f3b9 and rotate any secrets on hosts that installed it.

Data as of 11 Jul 2026, 09:43 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-5640

What to do

Remove ecto-corsair-whisper-6f3b9 from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmecto-corsair-whisper-6f3b9	Affected 1.0.0 – 1.0.25 26 affected builds	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (8695ea17273c804f1a58e6c0b877de280f7472622065964245deb85cc62dae20) The package declares a postinstall lifecycle hook (postinstall.js) that runs automatically on `npm install`. The script shells out via curl to the EC2 IMDSv2 metadata endpoint to obtain IAM role credentials, exports them, then iterates AWS Secrets Manager across multiple regions calling `aws secretsmanager list-secrets` and `get-secret-value`, and additionally dumps any process environment variable matching `FLAG|HTB|SECRET|AWS_`. The captured blob is chunked and HTTP PUT to a hardcoded bare-IP destination (http://154.57.164.71:30782) framed as a fake 'manifest' JSON. Execution is gated by an `isAppWorker()` check (hostname matches a 12-hex Docker-style ID and cwd contains `/app/node_modules`), which narrows the victim profile to containerized CI/build workers but does not change the nature of the attack. Additional behavior includes scanning /app for HackTheBox flag patterns (`/HTB\{[^}]+\}/`) and reading /app/src/main.rs, /app/main.rs, /app/flag.txt. This is unambiguous install-time credential theft plus remote exfiltration: any installer whose container matches the gate has IAM role credentials, secrets, and environment-variable secrets sent to attacker-controlled infrastructure. ## Source: ghsa-malware (d0ca45bd5ff9251df7ade64227231b9db2164ed9c61735808e83cb5626c3505a) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Impact

Any system that installs this package and matches the containerized environment criteria is at risk of having AWS IAM credentials, secrets from AWS Secrets Manager, and sensitive environment variables stolen and sent to an attacker. This leads to a full compromise of the system and potentially the broader AWS environment accessible via the stolen credentials. The attacker may gain persistent access and control, making remediation difficult without secret rotation and system rebuild.

Defensive guidance

Immediate removal of the ecto-corsair-whisper-6f3b9 package is recommended. All AWS credentials and secrets accessible from the compromised system must be rotated immediately from a secure, uncompromised environment. Due to the high likelihood of full system compromise, affected systems should be considered untrusted and rebuilt or replaced. Monitor for any unauthorized access using the stolen credentials. Avoid installing untrusted or unknown npm packages, especially in containerized CI/build environments.

Summary

The ecto-corsair-whisper-6f3b9 npm package includes a postinstall script that runs automatically on npm install. This script accesses the EC2 IMDSv2 metadata endpoint to retrieve IAM role credentials, exports them, and enumerates AWS Secrets Manager secrets across multiple regions. It collects environment variables matching sensitive patterns and scans local files for HackTheBox flags. The collected data is chunked and exfiltrated via HTTP PUT to a hardcoded IP address. Execution is gated to containerized CI/build workers by hostname and working directory checks. This behavior constitutes install-time credential theft and remote exfiltration, resulting in full compromise of affected systems.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 10 Jul 2026, 09:40 UTC

Technical details

References

Community reviews