{"id":"MAL-2026-19227","kind":"package","aliases":["MAL-2026-19227"],"related":[],"title":"Malicious code in r17d-sec-research-marker (npm)","description":"---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (0dbf3def098b1620e001e0831b405dd03ec20787a88a28892163cdfbe2eadbee)\nOn `npm install`, the package's postinstall script (collect.js) runs shell listings of the home directory and current working directory, probes for the presence of installer credential/config files (~/.npmrc, ~/.gitconfig, ~/.config/gh, ~/.novus), enumerates all process.env variable names, and POSTs the collected JSON to a hardcoded anonymous inspection endpoint at webhook.site/f18b2445-73d1-478a-9d3f-1cb21a407c61. The host reconnaissance includes the output of `whoami`, OS/kernel info, home-directory listing, dotfile presence inventory, and the full environment variable name list — a dataset that reveals CI provider, cloud credential presence, and secret-store usage, suitable for follow-on credential targeting. The script's self-label as a 'security research POC collecting metadata only' does not change the behavior: the installer did not opt in, the destination is an anonymous third-party collector, and the presence inventory of credential paths is itself exfiltration.","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"r17d-sec-research-marker","fixed":[],"affected":"= 1.0.0","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-13T03:58:29+00:00","first_seen_at":"2026-11-13T05:11:56+00:00","triaged_at":"2026-11-13T05:12:56+00:00","updated_at":"2026-11-13T05:14:00+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-19227':12A,15A '-2026':11A,14A '/.config/gh':67C '/.gitconfig':66C '/.novus':68C '/.npmrc':65C '/f18b2445-73d1-478a-9d3f-1cb21a407c61.':88C '0dbf3def098b1620e001e0831b405dd03ec20787a88a28892163cdfbe2eadbee':36C 'amazon':34C 'amazon-inspector':33C 'anonym':82C,163C 'behavior':152C 'chang':150C 'ci':117C 'cloud':119C 'code':2A 'collect':77C,145C 'collect.js':45C 'collector':167C 'credenti':120C,132C,173C 'credential/config':63C 'current':54C 'dataset':114C 'destin':160C 'detail':25C 'directori':52C,56C,101C 'dotfil':103C 'edit':28C 'endpoint':84C 'enumer':69C 'environ':109C 'exfiltr':177C 'file':64C 'follow':130C 'follow-on':129C 'full':108C 'hardcod':81C 'home':51C,100C 'home-directori':99C 'host':90C 'includ':92C 'info':98C 'inspect':83C 'inspector':35C 'instal':39C,62C,154C 'inventori':105C,171C 'json':78C 'label':139C 'line':31C 'list':48C,102C,112C 'mal':10A,13A 'malici':1A,21B 'marker':8A,20A 'metadata':146C 'name':73C,111C 'npm':9A,38C 'opt':157C 'os/kernel':97C 'output':94C 'packag':22B,41C 'parti':166C 'path':174C 'per':23C 'poc':144C 'post':75C 'postinstal':43C 'presenc':60C,104C,121C,170C 'probe':57C 'process.env':71C 'provid':118C 'r17d':5A,17A 'r17d-sec-research-marker':4A,16A 'reconnaiss':91C 'research':7A,19A,143C 'reveal':116C 'run':46C 'script':44C,135C 'sec':6A,18A 'secret':124C 'secret-stor':123C 'secur':142C 'self':138C 'self-label':137C 'shell':47C 'sourc':24C,32C 'store':125C 'suitabl':127C 'target':133C 'third':165C 'third-parti':164C 'usag':126C 'variabl':72C,110C 'webhook.site':87C 'webhook.site/f18b2445-73d1-478a-9d3f-1cb21a407c61.':86C 'whoami':96C 'work':55C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["r17dsecresearchmarker"],"ptokens":["marker","r17d","research","sec"],"labels":["critical","malicious","npm","package"],"campaign_type":null,"search_a":"'-19227':12A,15A '-2026':11A,14A 'code':2A 'mal':10A,13A 'malici':1A 'marker':8A,20A 'npm':9A 'r17d':5A,17A 'r17d-sec-research-marker':4A,16A 'research':7A,19A 'sec':6A,18A","search_b":"'malici':21B 'packag':22B","search_c":"'/.config/gh':67C '/.gitconfig':66C '/.novus':68C '/.npmrc':65C '/f18b2445-73d1-478a-9d3f-1cb21a407c61.':88C '0dbf3def098b1620e001e0831b405dd03ec20787a88a28892163cdfbe2eadbee':36C 'amazon':34C 'amazon-inspector':33C 'anonym':82C,163C 'behavior':152C 'chang':150C 'ci':117C 'cloud':119C 'collect':77C,145C 'collect.js':45C 'collector':167C 'credenti':120C,132C,173C 'credential/config':63C 'current':54C 'dataset':114C 'destin':160C 'detail':25C 'directori':52C,56C,101C 'dotfil':103C 'edit':28C 'endpoint':84C 'enumer':69C 'environ':109C 'exfiltr':177C 'file':64C 'follow':130C 'follow-on':129C 'full':108C 'hardcod':81C 'home':51C,100C 'home-directori':99C 'host':90C 'includ':92C 'info':98C 'inspect':83C 'inspector':35C 'instal':39C,62C,154C 'inventori':105C,171C 'json':78C 'label':139C 'line':31C 'list':48C,102C,112C 'metadata':146C 'name':73C,111C 'npm':38C 'opt':157C 'os/kernel':97C 'output':94C 'packag':41C 'parti':166C 'path':174C 'per':23C 'poc':144C 'post':75C 'postinstal':43C 'presenc':60C,104C,121C,170C 'probe':57C 'process.env':71C 'provid':118C 'reconnaiss':91C 'research':143C 'reveal':116C 'run':46C 'script':44C,135C 'secret':124C 'secret-stor':123C 'secur':142C 'self':138C 'self-label':137C 'shell':47C 'sourc':24C,32C 'store':125C 'suitabl':127C 'target':133C 'third':165C 'third-parti':164C 'usag':126C 'variabl':72C,110C 'webhook.site':87C 'webhook.site/f18b2445-73d1-478a-9d3f-1cb21a407c61.':86C 'whoami':96C 'work':55C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T03:58:29+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-19227","url":"https://osv.dev/vulnerability/MAL-2026-19227","severity":"critical","published_at":"2026-11-13T03:58:29+00:00","modified_at":"2026-11-13T04:30:07+00:00","first_seen_at":"2026-11-13T05:11:56+00:00","fetched_at":"2026-11-13T05:11:56+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}