{"schema_version":"1.9.2","id":"MAL-2026-18368","published":"2026-10-28T05:37:50Z","modified":"2026-10-29T14:30:44.623901641Z","summary":"Malicious code in spectral-net-probe (npm)","details":"spectral-net-probe has no functional code. Versions 1.0.1 and 1.0.4 have a postinstall script that runs `node index.js` on npm install, which sends an HTTPS GET to a Cloudflare quick tunnel (`https://nobody-johnston-with-enabling.trycloudflare.com/aa?x=1` and `https://imaging-amazing-trunk-surgeons.trycloudflare.com/marker104?v=1`). Version 1.0.10 runs when the package is loaded: it fetches `/api/modules/ECT-654321` from `http://154.57.164.64:30664` and `http://127.0.0.1:3000`, reads up to ten local files whose paths the reply lists in `data.cargo_hold`, and PUTs the first 400 characters of their contents to `/api/modules/ECT-987654` on both hosts. It was published by the npm account kristol07, which published two more packages the same day (phantom-chartwinds and phantom-powder-keg, placeholder versions only so far).\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (ebe49a4f7fad4c096381b6b6a3fbc5500e92fdf59f9f0fcfae0dcd3c76e8f8e8)\nspectral-net-probe@1.0.10 is an active supply-chain attack. package.json declares a postinstall hook `node -e \"require('.').sync()\"` that loads index.js on `npm install`. index.js runs a top-level loop over a hardcoded base list including the bare-IP endpoint 154.57.164.64:30664, GETs `/api/modules/ECT-654321` to receive a comma-separated list of filesystem paths, reads each path with fs.readFileSync, and PUTs the file contents back to `/api/modules/ECT-987654` on the same remote. The remote operator chooses which files on the installer's host are read and uploaded. The uploaded body is wrapped in a fake `ecto_module` YAML manifest with fields like `cargo_hold` and `power_level: SYNCED`, and the package self-describes as a 'local module config sync helper' — a cover story disguising arbitrary file exfiltration as benign module-sync telemetry. The hardcoded bare-IP destination is not associated with any legitimate publisher infrastructure.\n","affected":[{"package":{"name":"spectral-net-probe","ecosystem":"npm","purl":"pkg:npm/spectral-net-probe"},"versions":["1.0.1","1.0.4","1.0.10"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"88bbef970e7fa5cfa45934efccaa89e4b4beeb30cc0139a45093b053353a4630","tlsh":"65c08cf55ce0c08aeb3002dde2aabe89e583d194685181deaba78ba32cc45f11a10490"}],"package_integrity":[{"filename":"spectral-net-probe-1.0.4.tgz","hashes":{"sha1":"c17cb70c67b7c5dfbd7580b9d7b8e8b1d1159388","sha512_sri":"sha512-+dngh9xJHO1K4hBwi4mQNBaNj6dG5MBpvA3bl2Lz6q3kksFsnl4t9Q4Xgg6tpciK4d4h4n1tQCW9/uGZ30XZYg=="}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/spectral-net-probe/MAL-2026-18368.json"}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/spectral-net-probe"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/spectral-net-probe/v/1.0.4"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/spectral-net-probe/v/1.0.1"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/spectral-net-probe/v/1.0.10"}],"database_specific":{"iocs":{"files":[{"digests":{"sha256":"7a6c6de967bf3ed91cc46d59d8c0934a92d2d1d1554d45b07295a8b30526d791"},"note":"Main module of spectral-net-probe@1.0.10; runs on require, reads files listed by 154.57.164.64:30664 and PUTs their contents back.","paths":["index.js"],"source":"PACKAGE_ARCHIVE"},{"digests":{"sha256":"e0af9e2a480ebbd6362db84a631a1b1840a3e9992098ddc1d752b2b8895ea722"},"note":"postinstall script: node index.js","paths":["package.json"],"source":"PACKAGE_ARCHIVE"},{"digests":{"sha256":"0385a9b88818b96708d6c93a7e6c6328ec39643653b89d1de48554cc7e05eb79"},"note":"Executed by the postinstall script of spectral-net-probe@1.0.1.","paths":["index.js"],"source":"PACKAGE_ARCHIVE"},{"digests":{"sha256":"f36c8163900065c171c7172cc7b30553990726b6772a73c9706ce72368d40817"},"note":"postinstall script: node index.js","paths":["package.json"],"source":"PACKAGE_ARCHIVE"},{"digests":{"sha256":"88bbef970e7fa5cfa45934efccaa89e4b4beeb30cc0139a45093b053353a4630"},"note":"Executed by the postinstall script of spectral-net-probe@1.0.4.","paths":["index.js"],"source":"PACKAGE_ARCHIVE"},{"digests":{"sha256":"ffa6e421cd65a24492700f33589acb1d97782f1a66137ddf0de7fc847661d267"},"note":"postinstall script: node -e \"require(\".\").sync()\"","paths":["package.json"],"source":"PACKAGE_ARCHIVE"}],"ips":["154.57.164.64"],"urls":["https://nobody-johnston-with-enabling.trycloudflare.com/aa?x=1","https://imaging-amazing-trunk-surgeons.trycloudflare.com/marker104?v=1","http://154.57.164.64:30664/api/modules/ECT-654321","http://154.57.164.64:30664/api/modules/ECT-987654"]},"malicious-packages-origins":[{"id":"IN-MAL-2026-022031","import_time":"2026-10-29T14:14:19.246590062Z","modified_time":"2026-10-29T13:39:50Z","sha256":"375a3c21964244eabf8b9ea6129b9337777bbbf16ff6e4ea5c288136c1db1196","source":"amazon-inspector","versions":["1.0.4"]},{"id":"IN-MAL-2026-022030","import_time":"2026-10-29T14:14:19.153917313Z","modified_time":"2026-10-29T13:39:40Z","sha256":"df1803f03805e2ef5bc0d034f2e37bf0fb65fb4e6c9ee21828c24caa24a6ad99","source":"amazon-inspector","versions":["1.0.1"]},{"id":"IN-MAL-2026-022024","import_time":"2026-10-29T14:14:18.537802328Z","modified_time":"2026-10-29T13:38:58Z","sha256":"ebe49a4f7fad4c096381b6b6a3fbc5500e92fdf59f9f0fcfae0dcd3c76e8f8e8","source":"amazon-inspector","versions":["1.0.10"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"InvisiRisk, Inc.","contact":["https://www.invisirisk.com","mailto:research@invisirisk.com"],"type":"FINDER"}]}