MalwarePublished 29 Jun 2026Updated 9 Jul 2026

ledgerflow-deploy-utils (npm) · Malicious Code

Affects ledgerflow-deploy-utilsSource GCVE Database

Malicious package : remove ledgerflow-deploy-utils and rotate any secrets on hosts that installed it.

Data as of 11 Jul 2026, 09:43 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-6591

What to do

Remove ledgerflow-deploy-utils from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmledgerflow-deploy-utils	Affected =1.0.1	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (5f0097d19be676ac30ff79dffcff38f128873c80115a8a150c3eceff0422aa93) On npm install, the package's postinstall script queries the AWS instance metadata service (IMDSv1) at 169.254.169.254 for the attached IAM role and POSTs the result, along with an IMDS-reachability probe, over plain HTTP to a hardcoded bare IP (54.226.194.239:80/chain3). The published library surface (index.js) only exports two no-op console.log stubs named validate/deploy, with no real functionality — the entire effective behavior is the install-time reconnaissance against AWS-hosted installers and CI runners. The combination of a placeholder API, a generic deployment-utility name suggesting an internal/private package, and install-time recon to a hardcoded bare-IP C2 matches the dependency-confusion / internal-name-squat pattern targeting corporate build systems, where exposed IAM role names enable follow-on credential abuse against the installer's cloud environment.

Impact

If installed in an AWS-hosted environment, this package can leak IAM role credentials to an attacker-controlled server. This exposure enables potential follow-on credential abuse, including unauthorized access to cloud resources. The malicious behavior occurs silently during installation, making detection difficult. No direct exploit in the wild is currently known, but the impact of credential theft is high.

Defensive guidance

Users should avoid installing ledgerflow-deploy-utils version 1.0.1. Review and restrict usage of internal or private npm packages to prevent dependency confusion attacks. Monitor for unexpected network connections to suspicious IP addresses during package installation. Check vendor advisories or npm security advisories for updates or removal of the malicious package.

Summary

The ledgerflow-deploy-utils npm package (version 1.0.1) includes a postinstall script that accesses the AWS instance metadata service at 169.254.169.254 to obtain IAM role credentials. It then transmits these credentials and a reachability probe to a hardcoded IP address (54.226.194.239) over plain HTTP. The package exports only placeholder functions with no real functionality, indicating the main intent is to perform install-time reconnaissance on AWS-hosted environments. This technique is consistent with dependency confusion or internal name squatting attacks aimed at stealing cloud credentials from corporate build systems and CI runners.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 10 Jul 2026, 12:06 UTC

Technical details

References

Community reviews