Malicious code in bulk-add-sdk (npm)

CISA KEV lists vulnerabilities known to be exploited. FIRST EPSS estimates the likelihood of exploitation in the next 30 days. An unavailable score does not mean zero risk.

No exploitation or prediction data is available here for these CVEs. This does not mean they are safe or unlikely to be exploited.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (b131d84c624f7eb89d720ed0ec1435eef5f5f9ff800d1cef88b20c18c7374023) Package declares scripts.install: "node extract.js thd-orangepay", causing extract.js to run automatically on npm install. The script collects hostname, platform, arch, cwd, and the machine's public IP (obtained by shelling out via execSync to `curl -s ifconfig.me || wget...`) and transmits the data to a hardcoded subdomain of wallclip.me over two channels: an HTTPS POST via https.request with rejectUnauthorized: false (disabling certificate verification), and a DNS lookup against a beacon of the form `${project_id}.${safeHost}.[...].wallclip.me` so a passive DNS observer receives the hostname and project identifier even when outbound TCP/443 is blocked. The package main entry is a stub with no library functionality, so the install-time beacon is the package's sole effect. The package name resembles a legitimate SDK but ships only a reconnaissance beacon targeting a non-first-party domain.

Source published

21 Sep 2026 03:30:03 UTC

Source modified

21 Sep 2026 04:00:06 UTC

Saved here

24 Oct 2026 13:17:17 UTC

Source terms

OSV · upstream source license applies

Original source record · Cite this exact observation · Complete original publisher JSON

Source: osv · OSV · upstream source license applies. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.