Malicious code in merge-grid-stats (npm)
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (65aa3700b74bc0d50e4a4ee4fb3b903af0ac2ebea5867a3d1ffd0876647ec2a1) Package advertises itself as a 2048-style grid game statistics utility, but its declared postinstall hook (`node install-cb.js`) executes on `npm install` and performs behavior unrelated to that purpose. The postinstall shells out via execSync to run `uname -a` and `id`, reads `/proc/1/cgroup` and `/proc/mounts`, inspects Linux capabilities, checks for `/var/run/docker.sock`, and reads the Kubernetes service-account token and namespace at `/var/run/secrets/kubernetes.io/serviceaccount/`. It also enumerates `/`, `/root`, `/root/projects`, performs a host write-test, inspects network configuration, and greps the process environment for variables matching `token|secret|key|password|db_|redis|s3` and related patterns. The collected data (including the k8s SA token length and env keys) is written to `NCODE_ESCAPE.txt` in the current working directory and two parent directories. Author metadata is placeholder-shaped (`merge-tools <[email protected]>`) and the README/behavior mismatch indicates a cover-story shape. The install-time read of an installer-owned Kubernetes service-account token plus environment secret enumeration constitutes installer-side credential access and container-escape reconnaissance staging.
AI Analysis
Technical Summary
The 'merge-grid-stats' npm package, advertised as a 2048-style grid game statistics utility, includes a postinstall hook that executes arbitrary system commands during 'npm install'. This hook collects sensitive data such as system information (via 'uname -a', 'id'), Linux capabilities, Docker socket presence, Kubernetes service-account tokens, and environment variables matching secret-related patterns. The collected data is written to files in multiple directories. The package's author metadata and README are misleading, indicating a cover story. This installer-side credential access and reconnaissance behavior poses a security risk, especially in containerized environments.
Potential Impact
The malicious postinstall script can access sensitive credentials and environment secrets on the host or container where the package is installed. This includes Kubernetes service-account tokens and environment variables that may contain secrets or keys. Such access can lead to credential compromise and facilitate container escape or lateral movement within the environment.
Mitigation Recommendations
No official patch or remediation is currently documented. Users should avoid installing the 'merge-grid-stats' package versions 1.0.0 through 1.5.0. Verify package authenticity before installation and consider using trusted package sources or scanning tools to detect malicious postinstall scripts. Monitor for suspicious files like 'NCODE_ESCAPE.txt' created during installation.
Malicious code in merge-grid-stats (npm)
Description
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (65aa3700b74bc0d50e4a4ee4fb3b903af0ac2ebea5867a3d1ffd0876647ec2a1) Package advertises itself as a 2048-style grid game statistics utility, but its declared postinstall hook (`node install-cb.js`) executes on `npm install` and performs behavior unrelated to that purpose. The postinstall shells out via execSync to run `uname -a` and `id`, reads `/proc/1/cgroup` and `/proc/mounts`, inspects Linux capabilities, checks for `/var/run/docker.sock`, and reads the Kubernetes service-account token and namespace at `/var/run/secrets/kubernetes.io/serviceaccount/`. It also enumerates `/`, `/root`, `/root/projects`, performs a host write-test, inspects network configuration, and greps the process environment for variables matching `token|secret|key|password|db_|redis|s3` and related patterns. The collected data (including the k8s SA token length and env keys) is written to `NCODE_ESCAPE.txt` in the current working directory and two parent directories. Author metadata is placeholder-shaped (`merge-tools <[email protected]>`) and the README/behavior mismatch indicates a cover-story shape. The install-time read of an installer-owned Kubernetes service-account token plus environment secret enumeration constitutes installer-side credential access and container-escape reconnaissance staging.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The 'merge-grid-stats' npm package, advertised as a 2048-style grid game statistics utility, includes a postinstall hook that executes arbitrary system commands during 'npm install'. This hook collects sensitive data such as system information (via 'uname -a', 'id'), Linux capabilities, Docker socket presence, Kubernetes service-account tokens, and environment variables matching secret-related patterns. The collected data is written to files in multiple directories. The package's author metadata and README are misleading, indicating a cover story. This installer-side credential access and reconnaissance behavior poses a security risk, especially in containerized environments.
Potential Impact
The malicious postinstall script can access sensitive credentials and environment secrets on the host or container where the package is installed. This includes Kubernetes service-account tokens and environment variables that may contain secrets or keys. Such access can lead to credential compromise and facilitate container escape or lateral movement within the environment.
Mitigation Recommendations
No official patch or remediation is currently documented. Users should avoid installing the 'merge-grid-stats' package versions 1.0.0 through 1.5.0. Verify package authenticity before installation and consider using trusted package sources or scanning tools to detect malicious postinstall scripts. Monitor for suspicious files like 'NCODE_ESCAPE.txt' created during installation.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-13484
- Osv Schema Version
- 1.7.4
- Ecosystems
- ["npm"]
Threat ID: 6a757399bf8831d539d91a17
Added to database: 08/07/2026, 05:56:41 UTC
Last enriched: 08/07/2026, 09:01:16 UTC
Last updated: 09/21/2026, 22:47:29 UTC
Views: 21
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.