Malicious code in black-spindle-2 (npm)
Exact source revision recorded 29 Oct 2026 16:12:34 UTC. It does not establish the source's current position. Latest evidence.
osv · MAL-2026-18376
Published--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (433228fbed18f3104fed4cd1bce59bc5a76b8ea061d18c8fc9516c92b6b26e90) package.json declares a postinstall script that runs curl against the ephemeral host http://778e-181-63-25-28.ngrok-free.app over plain HTTP, embedding a shell command-substitution expression in the URL path. The script fires automatically on npm install, confirming installation on the installer's machine and providing a channel to exfiltrate host or environment values via the expanded shell expression. The shipped index.js is an empty stub, so the manifest's postinstall beacon is the package's entire effect. The destination is an anonymous ngrok-free.app tunnel with no relationship to any legitimate publisher, consistent with a dependency-confusion or install-confirmation probe.
- Source published
- 29 Oct 2026 14:59:21 UTC
- Source modified
- 29 Oct 2026 15:30:05 UTC
- Observed here
- 29 Oct 2026 16:12:34 UTC
- Source terms
- OSV · upstream source license applies
Original source record · Cite this exact observation · Complete original publisher JSON
This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · OSV · upstream source license applies. Source text is retained; field grouping and change labels are provided by ChangeIntel.