{"id":"MAL-2026-18368","revision":"ff8e40260b15477790b9b0b117217d2f","records":[{"revision":"ff8e40260b15477790b9b0b117217d2f","observedAt":"2026-10-29T09:48:08.617+00:00","statement":{"source":"osv","id":"MAL-2026-18368","aliases":[],"title":"Malicious code in spectral-net-probe (npm)","description":"spectral-net-probe has no functional code. Versions 1.0.1 and 1.0.4 have a postinstall script that runs `node index.js` on npm install, which sends an HTTPS GET to a Cloudflare quick tunnel (`https://nobody-johnston-with-enabling.trycloudflare.com/aa?x=1` and `https://imaging-amazing-trunk-surgeons.trycloudflare.com/marker104?v=1`). Version 1.0.10 runs when the package is loaded: it fetches `/api/modules/ECT-654321` from `http://154.57.164.64:30664` and `http://127.0.0.1:3000`, reads up to ten local files whose paths the reply lists in `data.cargo_hold`, and PUTs the first 400 characters of their contents to `/api/modules/ECT-987654` on both hosts. It was published by the npm account kristol07, which published two more packages the same day (phantom-chartwinds and phantom-powder-keg, placeholder versions only so far).","state":0,"publishedAt":"2026-10-28T05:37:50+00:00","modifiedAt":"2026-10-29T09:00:05.0804508+00:00","affected":[{"ecosystem":"npm","name":"spectral-net-probe","ranges":[],"versions":["1.0.1","1.0.4","1.0.10"],"rawVersionEvidence":null}],"metrics":[],"references":["https://www.npmjs.com/package/spectral-net-probe"],"sourceUrl":"https://osv.dev/vulnerability/MAL-2026-18368","license":"OSV · upstream source license applies","key":"osv:MAL-2026-18368","identifiers":["MAL-2026-18368"]},"retained":false,"historicalAffected":[]}],"coverage":[]}