Malicious code in npm-groat (npm)
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (eda7da760041a49d296b9a6e8cfa90ec4b7e5daecebbf50c88d41f7fd559a1b1) [email protected] declares a postinstall script that executes dist/config.js on npm install. That script performs an outbound fetch to https://my-api.trade-api.workers.dev?id=0 and then evaluates the response by calling globalThis[data.success](data.id) — treating attacker-controlled JSON fields as the name of a global function (e.g. eval or Function) and its argument. This gives the remote endpoint arbitrary code execution on the installer's host during package installation. The same file also contains a bare globalThis[tag](text) referencing undeclared identifiers, consistent with a dead-drop stager rather than legitimate configuration. The package's advertised purpose has no need to contact a remote server at install time.
AI Analysis
Technical Summary
The npm-groat package versions 1.1.1 and 1.1.2 include a postinstall script that executes dist/config.js during npm install. This script performs an outbound fetch to a remote URL and then evaluates the response by invoking a global function named by attacker-controlled JSON fields, enabling arbitrary code execution on the installer's host. The presence of undeclared identifiers used in a globalThis[tag](text) call suggests a dead-drop stager mechanism. The package's legitimate purpose does not require contacting a remote server at install time, confirming malicious intent.
Potential Impact
Arbitrary code execution occurs on the host system during package installation, allowing an attacker to run any code remotely. This can lead to full system compromise, data theft, or further malware deployment. The compromise occurs silently during installation, increasing risk to developers and automated build environments that use this package.
Mitigation Recommendations
No official patch or remediation is currently documented. Users should immediately avoid installing or updating to versions 1.1.1 and 1.1.2 of npm-groat. Remove the package from existing projects and replace it with a trusted alternative. Monitor for updates from the package maintainer or npm security advisories for any official fixes or removals.
Malicious code in npm-groat (npm)
Description
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (eda7da760041a49d296b9a6e8cfa90ec4b7e5daecebbf50c88d41f7fd559a1b1) [email protected] declares a postinstall script that executes dist/config.js on npm install. That script performs an outbound fetch to https://my-api.trade-api.workers.dev?id=0 and then evaluates the response by calling globalThis[data.success](data.id) — treating attacker-controlled JSON fields as the name of a global function (e.g. eval or Function) and its argument. This gives the remote endpoint arbitrary code execution on the installer's host during package installation. The same file also contains a bare globalThis[tag](text) referencing undeclared identifiers, consistent with a dead-drop stager rather than legitimate configuration. The package's advertised purpose has no need to contact a remote server at install time.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The npm-groat package versions 1.1.1 and 1.1.2 include a postinstall script that executes dist/config.js during npm install. This script performs an outbound fetch to a remote URL and then evaluates the response by invoking a global function named by attacker-controlled JSON fields, enabling arbitrary code execution on the installer's host. The presence of undeclared identifiers used in a globalThis[tag](text) call suggests a dead-drop stager mechanism. The package's legitimate purpose does not require contacting a remote server at install time, confirming malicious intent.
Potential Impact
Arbitrary code execution occurs on the host system during package installation, allowing an attacker to run any code remotely. This can lead to full system compromise, data theft, or further malware deployment. The compromise occurs silently during installation, increasing risk to developers and automated build environments that use this package.
Mitigation Recommendations
No official patch or remediation is currently documented. Users should immediately avoid installing or updating to versions 1.1.1 and 1.1.2 of npm-groat. Remove the package from existing projects and replace it with a trusted alternative. Monitor for updates from the package maintainer or npm security advisories for any official fixes or removals.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-12798
- Osv Schema Version
- 1.7.4
- Aliases
- []
- Ecosystems
- ["npm"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a735730bf8831d53913cd74
Added to database: 08/05/2026, 15:30:56 UTC
Last enriched: 08/05/2026, 15:39:16 UTC
Last updated: 08/05/2026, 15:39:17 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.