Malicious code in spectral-net-probe (npm)

spectral-net-probe has no functional code. Versions 1.0.1 and 1.0.4 have a postinstall script that runs `node index.js` on npm install, which sends an HTTPS GET to a Cloudflare quick tunnel (`https://nobody-johnston-with-enabling.trycloudflare.com/aa?x=1` and `https://imaging-amazing-trunk-surgeons.trycloudflare.com/marker104?v=1`). Version 1.0.10 runs when the package is loaded: it fetches `/api/modules/ECT-654321` from `http://154.57.164.64:30664` and `http://127.0.0.1:3000`, reads up to ten local files whose paths the reply lists in `data.cargo_hold`, and PUTs the first 400 characters of their contents to `/api/modules/ECT-987654` on both hosts. It was published by the npm account kristol07, which published two more packages the same day (phantom-chartwinds and phantom-powder-keg, placeholder versions only so far).

Source published

28 Oct 2026 05:37:50 UTC

Source modified

29 Oct 2026 09:00:05 UTC

Observed here

29 Oct 2026 09:48:08 UTC

Source terms

OSV · upstream source license applies

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · OSV · upstream source license applies. Source text is retained; field grouping and change labels are provided by ChangeIntel.