{"id":"MAL-2026-18368","revision":"666187ac24564f78b1dc3359794203de","records":[{"revision":"666187ac24564f78b1dc3359794203de","observedAt":"2026-10-29T15:12:22.973+00:00","statement":{"source":"osv","id":"MAL-2026-18368","aliases":[],"title":"Malicious code in spectral-net-probe (npm)","description":"spectral-net-probe has no functional code. Versions 1.0.1 and 1.0.4 have a postinstall script that runs `node index.js` on npm install, which sends an HTTPS GET to a Cloudflare quick tunnel (`https://nobody-johnston-with-enabling.trycloudflare.com/aa?x=1` and `https://imaging-amazing-trunk-surgeons.trycloudflare.com/marker104?v=1`). Version 1.0.10 runs when the package is loaded: it fetches `/api/modules/ECT-654321` from `http://154.57.164.64:30664` and `http://127.0.0.1:3000`, reads up to ten local files whose paths the reply lists in `data.cargo_hold`, and PUTs the first 400 characters of their contents to `/api/modules/ECT-987654` on both hosts. It was published by the npm account kristol07, which published two more packages the same day (phantom-chartwinds and phantom-powder-keg, placeholder versions only so far).\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (ebe49a4f7fad4c096381b6b6a3fbc5500e92fdf59f9f0fcfae0dcd3c76e8f8e8)\nspectral-net-probe@1.0.10 is an active supply-chain attack. package.json declares a postinstall hook `node -e \"require('.').sync()\"` that loads index.js on `npm install`. index.js runs a top-level loop over a hardcoded base list including the bare-IP endpoint 154.57.164.64:30664, GETs `/api/modules/ECT-654321` to receive a comma-separated list of filesystem paths, reads each path with fs.readFileSync, and PUTs the file contents back to `/api/modules/ECT-987654` on the same remote. The remote operator chooses which files on the installer's host are read and uploaded. The uploaded body is wrapped in a fake `ecto_module` YAML manifest with fields like `cargo_hold` and `power_level: SYNCED`, and the package self-describes as a 'local module config sync helper' — a cover story disguising arbitrary file exfiltration as benign module-sync telemetry. The hardcoded bare-IP destination is not associated with any legitimate publisher infrastructure.\n","state":0,"publishedAt":"2026-10-28T05:37:50+00:00","modifiedAt":"2026-10-29T14:30:44.6239016+00:00","affected":[{"ecosystem":"npm","name":"spectral-net-probe","ranges":[],"versions":["1.0.1","1.0.4","1.0.10"],"rawVersionEvidence":null}],"metrics":[],"references":["https://www.npmjs.com/package/spectral-net-probe","https://www.npmjs.com/package/spectral-net-probe/v/1.0.4","https://www.npmjs.com/package/spectral-net-probe/v/1.0.1","https://www.npmjs.com/package/spectral-net-probe/v/1.0.10"],"sourceUrl":"https://osv.dev/vulnerability/MAL-2026-18368","license":"OSV · upstream source license applies","key":"osv:MAL-2026-18368","identifiers":["MAL-2026-18368"]},"retained":false,"historicalAffected":[]}],"coverage":[]}