{"answers":{"affected":"1 open source package ship an affected version, including zer0onetencent.","exploited":"There is no known exploitation of MAL-2026-10944 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-10944 is a malicious package in zer0onetencent, published on 20 Jul 2026."},"fix_prompt":"MAL-2026-10944 is a malicious package: zer0onetencent (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-10944/ (Markdown: https://insights.sbomify.com/MAL-2026-10944/index.md)","id":"MAL-2026-10944","markdown":"https://insights.sbomify.com/MAL-2026-10944/index.md","name":"MAL-2026-10944","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"The zer0onetencent package was published to the npm registry by user 't2423048543' (maintainer email t2423048543@gmail.com). It is described as 'A simple date formatting utility' but ships no such functionality; index.js only exports a hello() stub returning the package name, indicating a package created to deliver an install-time payload.\n\nThe package.json declares a postinstall hook (\"node postinstall.js\") that runs automatically at npm install time. The bundled postinstall.js embeds a shell command chain that performs cloud-metadata SSRF and credential/environment harvesting: it queries a public IP echo service (http://cip.cc), probes a Meituan/Sankuai internal SSRF test endpoint (https://mtsrc-test.sankuai.com/ssrf), requests AWS EC2 instance metadata credentials for the IAM role 'sandyclaw-canary-worker-role' (http://169.254.169.254/latest/meta-data/iam/security-credentials/sandyclaw-canary-worker-role), and reads Tencent Cloud metadata (http://metadata.tencentyun.com/latest/meta-data/ and http://169.254.0.23/latest/meta-data/). It then reads the installing process's environment via /proc/self/environ and exfiltrates the concatenated output, together with a directory listing of /data/, by HTTP POST to the attacker-controlled Burp Collaborator endpoint http://t5z0g2hzoydgi8mz3pfkzg8dm4svgl4a.oastify.com (paths /metadata and /data).\n\nAs shipped, the malicious command chain is stored inside postinstall.js as a JSON document (a copy of a package manifest) rather than as executable JavaScript, so the 'node postinstall.js' hook raises a syntax error and the embedded payload does not execute as-published; the intent and payload are nonetheless unambiguously malicious. A sibling package (zer0onetencent2) by the same maintainer carries an identical payload differing only in the Collaborator subdomain.\n\nThe package is presented as 'A simple date formatting utility' with a trivial index.js exporting a hello() function, but its postinstall lifecycle script executes a shell one-liner that queries cloud instance metadata services — the AWS IMDS role credentials endpoint at 169.254.169.254 (path /latest/meta-data/iam/security-credentials/sandyclaw-canary-worker-role), the Tencent Cloud metadata service at metadata.tencentyun.com, and an additional internal SSRF endpoint — writes the responses to /tmp, reads /proc/self/environ, then POSTs the aggregated output to the hardcoded Burp Collaborator subdomain t5z0g2hzoydgi8mz3pfkzg8dm4svgl4a.oastify.com. Running on cloud build infrastructure yields short-lived IAM/STS credentials and installer environment variables to the operator of that collaborator host. The stated package purpose is a decoy for the install-time credential-harvest behavior.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in zer0onetencent (npm)","id":"MAL-2026-10944","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":["0"],"last_affected":[],"package":"zer0onetencent","purl":"pkg:npm/zer0onetencent","source":"MAL-2026-10944"}],"products":null,"published":"2026-07-20","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-10944/"}