Live › package › MAL-2026-18376
Not triaged yet. The sources’ own description is below.
First seen by InfraStack 2026-10-29 16:25 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| black-spindle-2 | npm | = 301.0.0; = 100.0.0 | – |
Unknown from the sources.
Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
-= Per source details. Do not edit below this line.=-
package.json declares a postinstall script that runs curl against the ephemeral host http://778e-181-63-25-28.ngrok-free.app over plain HTTP, embedding a shell command-substitution expression in the URL path. The script fires automatically on npm install, confirming installation on the installer's machine and providing a channel to exfiltrate host or environment values via the expanded shell expression. The shipped index.js is an empty stub, so the manifest's postinstall beacon is the package's entire effect. The destination is an anonymous ngrok-free.app tunnel with no relationship to any legitimate publisher, consistent with a dependency-confusion or install-confirmation probe.
This page as .md · .json · in your agent: get_signal("MAL-2026-18376")