{"id":"MAL-2026-18368","kind":"package","aliases":["MAL-2026-18368"],"related":[],"title":"Malicious code in spectral-net-probe (npm)","description":"spectral-net-probe has no functional code. Versions 1.0.1 and 1.0.4 have a postinstall script that runs `node index.js` on npm install, which sends an HTTPS GET to a Cloudflare quick tunnel (`https://nobody-johnston-with-enabling.trycloudflare.com/aa?x=1` and `https://imaging-amazing-trunk-surgeons.trycloudflare.com/marker104?v=1`). Version 1.0.10 runs when the package is loaded: it fetches `/api/modules/ECT-654321` from `http://154.57.164.64:30664` and `http://127.0.0.1:3000`, reads up to ten local files whose paths the reply lists in `data.cargo_hold`, and PUTs the first 400 characters of their contents to `/api/modules/ECT-987654` on both hosts. It was published by the npm account kristol07, which published two more packages the same day (phantom-chartwinds and phantom-powder-keg, placeholder versions only so far).","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"spectral-net-probe","fixed":[],"affected":"= 1.0.1; = 1.0.4; = 1.0.10","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-28T05:37:50+00:00","first_seen_at":"2026-10-29T09:53:35+00:00","triaged_at":"2026-10-29T09:53:53+00:00","updated_at":"2026-10-29T09:56:48+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-18368':11A,14A '-2026':10A,13A '/aa?x=1':56C '/api/modules/ect-654321':71C '/api/modules/ect-987654':102C '/marker104?v=1':60C '1.0.1':30C '1.0.10':62C '1.0.4':32C '127.0.0.1':76C '154.57.164.64':73C '3000':77C '30664':74C '400':96C 'account':112C 'charact':97C 'chartwind':124C 'cloudflar':51C 'code':2A,28C 'content':100C 'data.cargo':90C 'day':121C 'far':134C 'fetch':70C 'file':83C 'first':95C 'function':27C 'get':48C 'hold':91C 'host':105C 'https':47C 'imaging-amazing-trunk-surgeons.trycloudflare.com':59C 'imaging-amazing-trunk-surgeons.trycloudflare.com/marker104?v=1':58C 'index.js':40C 'instal':43C 'keg':129C 'kristol07':113C 'list':88C 'load':68C 'local':82C 'mal':9A,12A 'malici':1A,19B 'net':6A,17A,23C 'nobody-johnston-with-enabling.trycloudflare.com':55C 'nobody-johnston-with-enabling.trycloudflare.com/aa?x=1':54C 'node':39C 'npm':8A,42C,111C 'packag':20B,66C,118C 'path':85C 'phantom':123C,127C 'phantom-chartwind':122C 'phantom-powder-keg':126C 'placehold':130C 'postinstal':35C 'powder':128C 'probe':7A,18A,24C 'publish':108C,115C 'put':93C 'quick':52C 'read':78C 'repli':87C 'run':38C,63C 'script':36C 'send':45C 'spectral':5A,16A,22C 'spectral-net-prob':4A,21C 'spectral-net-probe':15A 'ten':81C 'tunnel':53C 'two':116C 'version':29C,61C,131C 'whose':84C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"first_public_at":"2026-10-28T05:37:50+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-18368","url":"https://osv.dev/vulnerability/MAL-2026-18368","severity":"critical","published_at":"2026-10-28T05:37:50+00:00","modified_at":"2026-10-29T09:00:05+00:00","first_seen_at":"2026-10-29T09:53:35+00:00","fetched_at":"2026-10-29T09:53:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}