Malicious code in @sectest429/hello-npm-world (npm)
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (479b9303d76a49dfacb402f0a906e32686b5d276e23f429678150e73e506550d) The package advertises a single function `module.exports = function hello(name)` but ships a `preinstall.js` lifecycle script that runs automatically on `npm install` and performs reconnaissance unrelated to the advertised functionality. The script collects OS username, hostname, platform/arch, and the full running process list (`ps -eo comm=` on POSIX, `tasklist /fo csv /nh` on Windows), and issues an HTTP PUT to the AWS EC2 link-local IMDSv2 token endpoint at `169.254.169.254/latest/api/token` followed by a fetch of `/latest/meta-data/instance-id`. Results are written to `./exfil.log` in the installer's working directory. The file's own header comment self-describes as a 'SECURITY DEMO payload' proving that a trojanized package gets code execution at install time. Even though the current version writes locally rather than transmitting, the recon chain (process enumeration + cloud-instance fingerprinting) has no relationship to a hello-world library, runs without consent on every install, and pollutes the consumer's CWD with an artifact. ## Source: ghsa-malware (11c60369d43860157d7d1d5e7740d89e0c0b4e759e89d162450e247e04b483a2) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
AI Analysis
Technical Summary
The @sectest429/hello-npm-world npm package version 1.0.3 includes a preinstall lifecycle script that executes automatically on npm install. This script performs system reconnaissance by gathering OS username, hostname, platform/architecture, and enumerating running processes. It also attempts to access AWS EC2 instance metadata by requesting an IMDSv2 token and fetching the instance ID from the link-local metadata service. The gathered information is saved to a local file named exfil.log in the installer's working directory. This behavior is unrelated to the package's advertised single function and occurs without user consent, constituting a trojanized package with unauthorized code execution during installation.
Potential Impact
The malicious preinstall script can collect sensitive system and cloud environment information without user knowledge or consent. While the current version only writes this data locally and does not exfiltrate it externally, the unauthorized code execution at install time poses a risk of further malicious actions if the code is modified. The presence of reconnaissance code in a seemingly benign package undermines trust and could facilitate targeted attacks or data leakage if extended.
Mitigation Recommendations
No official patch or remediation is currently documented for this package version. Users should avoid installing version 1.0.3 of @sectest429/hello-npm-world. Consider removing the package if already installed and monitor for updates or advisories from the package maintainer or npm registry. Since this is a trojanized package, verifying package integrity and sourcing from trusted authors is recommended to prevent similar issues.
Malicious code in @sectest429/hello-npm-world (npm)
Description
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (479b9303d76a49dfacb402f0a906e32686b5d276e23f429678150e73e506550d) The package advertises a single function `module.exports = function hello(name)` but ships a `preinstall.js` lifecycle script that runs automatically on `npm install` and performs reconnaissance unrelated to the advertised functionality. The script collects OS username, hostname, platform/arch, and the full running process list (`ps -eo comm=` on POSIX, `tasklist /fo csv /nh` on Windows), and issues an HTTP PUT to the AWS EC2 link-local IMDSv2 token endpoint at `169.254.169.254/latest/api/token` followed by a fetch of `/latest/meta-data/instance-id`. Results are written to `./exfil.log` in the installer's working directory. The file's own header comment self-describes as a 'SECURITY DEMO payload' proving that a trojanized package gets code execution at install time. Even though the current version writes locally rather than transmitting, the recon chain (process enumeration + cloud-instance fingerprinting) has no relationship to a hello-world library, runs without consent on every install, and pollutes the consumer's CWD with an artifact. ## Source: ghsa-malware (11c60369d43860157d7d1d5e7740d89e0c0b4e759e89d162450e247e04b483a2) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The @sectest429/hello-npm-world npm package version 1.0.3 includes a preinstall lifecycle script that executes automatically on npm install. This script performs system reconnaissance by gathering OS username, hostname, platform/architecture, and enumerating running processes. It also attempts to access AWS EC2 instance metadata by requesting an IMDSv2 token and fetching the instance ID from the link-local metadata service. The gathered information is saved to a local file named exfil.log in the installer's working directory. This behavior is unrelated to the package's advertised single function and occurs without user consent, constituting a trojanized package with unauthorized code execution during installation.
Potential Impact
The malicious preinstall script can collect sensitive system and cloud environment information without user knowledge or consent. While the current version only writes this data locally and does not exfiltrate it externally, the unauthorized code execution at install time poses a risk of further malicious actions if the code is modified. The presence of reconnaissance code in a seemingly benign package undermines trust and could facilitate targeted attacks or data leakage if extended.
Mitigation Recommendations
No official patch or remediation is currently documented for this package version. Users should avoid installing version 1.0.3 of @sectest429/hello-npm-world. Consider removing the package if already installed and monitor for updates or advisories from the package maintainer or npm registry. Since this is a trojanized package, verifying package integrity and sourcing from trusted authors is recommended to prevent similar issues.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-10478
- Osv Schema Version
- 1.7.4
- Aliases
- []
- Ecosystems
- ["npm"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a55ffa268715ace432f7345
Added to database: 07/14/2026, 09:21:38 UTC
Last enriched: 07/14/2026, 09:54:01 UTC
Last updated: 07/29/2026, 03:28:15 UTC
Views: 21
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.