MalwarePublished 6 Aug 2026

merge-grid-stats (npm) · Malicious Code

Affects merge-grid-statsSource GCVE Database

Malicious package : remove merge-grid-stats and rotate any secrets on hosts that installed it.

Data as of 7 Aug 2026, 15:17 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-13484

What to do

Remove merge-grid-stats from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmmerge-grid-stats	Affected 1.0.0 – 1.5.0 7 affected builds	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (65aa3700b74bc0d50e4a4ee4fb3b903af0ac2ebea5867a3d1ffd0876647ec2a1) Package advertises itself as a 2048-style grid game statistics utility, but its declared postinstall hook (`node install-cb.js`) executes on `npm install` and performs behavior unrelated to that purpose. The postinstall shells out via execSync to run `uname -a` and `id`, reads `/proc/1/cgroup` and `/proc/mounts`, inspects Linux capabilities, checks for `/var/run/docker.sock`, and reads the Kubernetes service-account token and namespace at `/var/run/secrets/kubernetes.io/serviceaccount/`. It also enumerates `/`, `/root`, `/root/projects`, performs a host write-test, inspects network configuration, and greps the process environment for variables matching `token|secret|key|password|db_|redis|s3` and related patterns. The collected data (including the k8s SA token length and env keys) is written to `NCODE_ESCAPE.txt` in the current working directory and two parent directories. Author metadata is placeholder-shaped (`merge-tools <merge-tools@example.com>`) and the README/behavior mismatch indicates a cover-story shape. The install-time read of an installer-owned Kubernetes service-account token plus environment secret enumeration constitutes installer-side credential access and container-escape reconnaissance staging.

Impact

The malicious postinstall script can access sensitive credentials and environment secrets on the host or container where the package is installed. This includes Kubernetes service-account tokens and environment variables that may contain secrets or keys. Such access can lead to credential compromise and facilitate container escape or lateral movement within the environment.

Defensive guidance

Users should avoid installing the 'merge-grid-stats' package versions 1.0.0 through 1.5.0. Verify package authenticity before installation and consider using trusted package sources or scanning tools to detect malicious postinstall scripts. Monitor for suspicious files like 'NCODE_ESCAPE.txt' created during installation.

Summary

The 'merge-grid-stats' npm package, advertised as a 2048-style grid game statistics utility, includes a postinstall hook that executes arbitrary system commands during 'npm install'. This hook collects sensitive data such as system information (via 'uname -a', 'id'), Linux capabilities, Docker socket presence, Kubernetes service-account tokens, and environment variables matching secret-related patterns. The collected data is written to files in multiple directories. The package's author metadata and README are misleading, indicating a cover story. This installer-side credential access and reconnaissance behavior poses a security risk, especially in containerized environments.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 7 Aug 2026, 09:01 UTC

Technical details

References

Community reviews