Malicious code in notafollower122 (npm)
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (83409fb8c0dc76764a944064219de6a4d59d6b24413db5e36d897681f3183add) package.json declares a postinstall lifecycle script that runs automatically on `npm install`. The script uses child_process to query the AWS ECS container metadata endpoint (ECS_CONTAINER_METADATA_URI_V4/task), which returns the cluster name, AWS account ID, task ARN, and container image list for the installer's ECS task, then POSTs the response body to the hardcoded ngrok tunnel https://mourner-slot-explicit.ngrok-free.dev via `curl -X POST... --data-binary @-`. The package ships only package.json with no source, build artifacts, or documented functionality, so the postinstall has no legitimate purpose. The destination is an anonymous, mutable ngrok tunnel with no relationship to any publisher — the shape of cloud-environment reconnaissance and exfiltration against AWS ECS installers.
Malicious code in notafollower122 (npm)
Description
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (83409fb8c0dc76764a944064219de6a4d59d6b24413db5e36d897681f3183add) package.json declares a postinstall lifecycle script that runs automatically on `npm install`. The script uses child_process to query the AWS ECS container metadata endpoint (ECS_CONTAINER_METADATA_URI_V4/task), which returns the cluster name, AWS account ID, task ARN, and container image list for the installer's ECS task, then POSTs the response body to the hardcoded ngrok tunnel https://mourner-slot-explicit.ngrok-free.dev via `curl -X POST... --data-binary @-`. The package ships only package.json with no source, build artifacts, or documented functionality, so the postinstall has no legitimate purpose. The destination is an anonymous, mutable ngrok tunnel with no relationship to any publisher — the shape of cloud-environment reconnaissance and exfiltration against AWS ECS installers.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-14035
- Osv Schema Version
- 1.7.4
- Aliases
- []
- Ecosystems
- ["npm"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a7f43f1bf8831d5395d76ee
Added to database: 08/14/2026, 16:36:01 UTC
Last updated: 08/14/2026, 16:36:58 UTC
Views: 1
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.