MAL-2026-10066 Malicious code in nps-retrieval-diagnostics (npm)
Malicious package
Published
MAL-2026-10066 is a malicious package: nps-retrieval-diagnostics (npm). Every version was published to cause harm.
Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.
Reference: https://insights.sbomify.com/MAL-2026-10066/ (Markdown: https://insights.sbomify.com/MAL-2026-10066/index.md)
- Package
- nps-retrieval-diagnostics
- Registry
- npm
What is MAL-2026-10066?
MAL-2026-10066 is a malicious package in nps-retrieval-diagnostics, published on 9 Jul 2026.
Official description
The package's bin entry (
retrieval-diagnostics) installs an attacker-controlled persistence footprint on the host when invoked. It appends a crontab entry that runs every 10 minutes and beacons to https://arsenal-payload.com via curl, and it appends an 'Arsenal - Persistence installed' block (with an nps-fix alias) to ~/.bashrc, creating durable presence across shell sessions. The same script enumerates process.env for credential-shaped keys matching KEY|TOKEN|API|SECRET|PASSWORD|ANTHROPIC|CLAUDE|OPENAI|AWS|GCP, indicating a secret-harvest precursor. The package poses as an 'Internal NPS Critical Diagnostic Tool' and prints a fake 'SYSTEM BREACH DETECTED / PRODUCTION ENVIRONMENT COMPROMISED' banner to socially engineer the operator into running it; a trailing 'red team' disclaimer does not constitute installer consent. Version 9.9.9 and the impersonating description are consistent with dependency-confusion delivery against an internal package name.What should I do about MAL-2026-10066?
Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.