MalwarePublished 14 Aug 2026

notafollower122 (npm) · Malicious Code

Affects notafollower122Source GCVE Database

Malicious package : remove notafollower122 and rotate any secrets on hosts that installed it.

Data as of 14 Aug 2026, 16:50 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-14035

What to do

Remove notafollower122 from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmnotafollower122	Affected 1.0.0 – 1.0.7 8 affected builds	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package 'notafollower122' contains malicious code in its postinstall script that executes automatically during installation. This script collects AWS ECS container metadata from the installer's environment and exfiltrates it to an anonymous ngrok tunnel. The package lacks any legitimate source code or documented functionality, indicating the postinstall script serves no valid purpose other than reconnaissance and data exfiltration. Multiple versions of the package (1.0.0 through 1.0.7) are affected.

Impact

Installation of affected versions of the 'notafollower122' package results in unauthorized disclosure of AWS ECS container metadata to an attacker-controlled endpoint. This leakage can expose sensitive cloud environment details, potentially aiding further attacks or reconnaissance. There is no indication of active exploitation in the wild at this time.

Defensive guidance

Users should avoid installing the 'notafollower122' package in any version. Review and remove any installations of this package from your environments. Monitor package sources carefully to prevent inclusion of malicious packages.

Summary

The 'notafollower122' npm package includes a postinstall lifecycle script that runs automatically on 'npm install'. This script uses Node.js child_process to query the AWS ECS container metadata endpoint (ECS_CONTAINER_METADATA_URI_V4/task), retrieving sensitive information such as cluster name, AWS account ID, task ARN, and container image list. It then sends this data via a POST request to a hardcoded, anonymous ngrok tunnel URL. The package contains only a package.json file without source code or build artifacts, confirming the postinstall script's malicious intent for cloud environment reconnaissance and exfiltration targeting AWS ECS environments.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 14 Aug 2026, 16:50 UTC

Technical details

References

Community reviews