Malicious code in habingeer (npm)
The habingeer npm package version 2.1.6 contains malicious code that executes automatically upon installation. It searches for sensitive files such as Solana keypairs and environment configuration files, exfiltrating their contents to a remote server. Additionally, on Linux systems, it fetches an SSH public key from a command-and-control server and appends it to the authorized_keys file, enabling persistent remote SSH access. The malware also modifies firewall rules to keep SSH accessible and uploads additional files from the host to the attacker’s server. These actions occur without user interaction during the npm install process.
AI Analysis
Technical Summary
The habingeer npm package version 2.1.6 includes a postinstall script that runs automatically on installation. This script performs three main malicious activities: (1) recursively searches the installation directory for sensitive files such as Solana keypairs (id.json), configuration files (config.toml, Config.toml), and environment files (.env), then exfiltrates their contents along with the installer's username to a remote server at 170.205.31.203:3000; (2) on Linux systems, retrieves an SSH public key from 170.205.31.203:3001, appends it to ~/.ssh/authorized_keys, and modifies firewall rules to ensure SSH access remains open, granting persistent remote access; (3) downloads scanning/blocking patterns from the C2 server, enumerates home directories or logical drives depending on OS, and uploads matching files with metadata to the attacker’s server. These behaviors activate automatically during installation without user consent.
Potential Impact
Sensitive files including private keys and environment configurations are exfiltrated to an attacker-controlled server, potentially compromising credentials and secrets. The attacker gains persistent remote SSH access on Linux hosts by injecting their public key and modifying firewall settings, enabling unauthorized interactive access. Additional files from the host are scanned and uploaded, increasing data exposure. This compromises confidentiality, integrity, and potentially availability of affected systems.
Mitigation Recommendations
No official patch or remediation is currently documented for habingeer version 2.1.6. Users should avoid installing this specific version. Remove any installations of habingeer 2.1.6 from systems and inspect for unauthorized SSH keys in ~/.ssh/authorized_keys on Linux hosts. Review firewall rules for unauthorized changes. Monitor for suspicious outbound network connections to IP 170.205.31.203. Since this is a malicious package, consider using trusted package sources and verifying package integrity before installation. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.
Malicious code in habingeer (npm)
Description
The habingeer npm package version 2.1.6 contains malicious code that executes automatically upon installation. It searches for sensitive files such as Solana keypairs and environment configuration files, exfiltrating their contents to a remote server. Additionally, on Linux systems, it fetches an SSH public key from a command-and-control server and appends it to the authorized_keys file, enabling persistent remote SSH access. The malware also modifies firewall rules to keep SSH accessible and uploads additional files from the host to the attacker’s server. These actions occur without user interaction during the npm install process.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The habingeer npm package version 2.1.6 includes a postinstall script that runs automatically on installation. This script performs three main malicious activities: (1) recursively searches the installation directory for sensitive files such as Solana keypairs (id.json), configuration files (config.toml, Config.toml), and environment files (.env), then exfiltrates their contents along with the installer's username to a remote server at 170.205.31.203:3000; (2) on Linux systems, retrieves an SSH public key from 170.205.31.203:3001, appends it to ~/.ssh/authorized_keys, and modifies firewall rules to ensure SSH access remains open, granting persistent remote access; (3) downloads scanning/blocking patterns from the C2 server, enumerates home directories or logical drives depending on OS, and uploads matching files with metadata to the attacker’s server. These behaviors activate automatically during installation without user consent.
Potential Impact
Sensitive files including private keys and environment configurations are exfiltrated to an attacker-controlled server, potentially compromising credentials and secrets. The attacker gains persistent remote SSH access on Linux hosts by injecting their public key and modifying firewall settings, enabling unauthorized interactive access. Additional files from the host are scanned and uploaded, increasing data exposure. This compromises confidentiality, integrity, and potentially availability of affected systems.
Mitigation Recommendations
No official patch or remediation is currently documented for habingeer version 2.1.6. Users should avoid installing this specific version. Remove any installations of habingeer 2.1.6 from systems and inspect for unauthorized SSH keys in ~/.ssh/authorized_keys on Linux hosts. Review firewall rules for unauthorized changes. Monitor for suspicious outbound network connections to IP 170.205.31.203. Since this is a malicious package, consider using trusted package sources and verifying package integrity before installation. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-10995
- Osv Schema Version
- 1.7.4
- Aliases
- []
- Ecosystems
- ["npm"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a6151129c2644c7f8da4f4e
Added to database: 07/22/2026, 23:24:02 UTC
Last enriched: 07/22/2026, 23:50:12 UTC
Last updated: 07/23/2026, 01:54:56 UTC
Views: 21
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.