{"answers":{"affected":"1 open source package ship an affected version, including zer0onetencent2.","exploited":"There is no known exploitation of MAL-2026-10945 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-10945 is a malicious package in zer0onetencent2, published on 20 Jul 2026."},"fix_prompt":"MAL-2026-10945 is a malicious package: zer0onetencent2 (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-10945/ (Markdown: https://insights.sbomify.com/MAL-2026-10945/index.md)","id":"MAL-2026-10945","markdown":"https://insights.sbomify.com/MAL-2026-10945/index.md","name":"MAL-2026-10945","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"The zer0onetencent2 package was published to the npm registry by user 't2423048543' (maintainer email t2423048543@gmail.com). It is described as 'A simple date formatting utility' but ships no such functionality; index.js only exports a hello() stub returning the package name, indicating a package created to deliver an install-time payload.\n\nThe package.json declares a postinstall hook (\"node postinstall.js\") that runs automatically at npm install time. The bundled postinstall.js embeds a shell command chain that performs cloud-metadata SSRF and credential/environment harvesting: it queries a public IP echo service (http://cip.cc), probes a Meituan/Sankuai internal SSRF test endpoint (https://mtsrc-test.sankuai.com/ssrf), requests AWS EC2 instance metadata credentials for the IAM role 'sandyclaw-canary-worker-role' (http://169.254.169.254/latest/meta-data/iam/security-credentials/sandyclaw-canary-worker-role), and reads Tencent Cloud metadata (http://metadata.tencentyun.com/latest/meta-data/ and http://169.254.0.23/latest/meta-data/). It then reads the installing process's environment via /proc/self/environ and exfiltrates the concatenated output, together with a directory listing of /data/, by HTTP POST to the attacker-controlled Burp Collaborator endpoint http://kuir5t6qdp277zbqsg4bo7x4bvhm5dt2.oastify.com (paths /metadata and /data).\n\nAs shipped, the malicious command chain is stored inside postinstall.js as a JSON document (a copy of a package manifest) rather than as executable JavaScript, so the 'node postinstall.js' hook raises a syntax error and the embedded payload does not execute as-published; the intent and payload are nonetheless unambiguously malicious. A sibling package (zer0onetencent) by the same maintainer carries an identical payload differing only in the Collaborator subdomain.\n\nThe package's postinstall.js lifecycle script runs automatically on npm install and performs credential harvesting against the installer's host or CI environment. It curls the AWS instance metadata service at 169.254.169.254 to retrieve IAM role credentials (writing them to /tmp/aws.txt), queries the Tencent Cloud metadata endpoint at metadata.tencentyun.com, probes an internal Meituan SSRF target, and reads /proc/self/environ to capture all process environment variables. The aggregated contents are POSTed with curl -X POST -d to http://kuir5t6qdp277zbqsg4bo7x4bvhm5dt2.oastify.com/metadata, a Burp Collaborator (oastify.com) attacker-controlled sink. A second POST exfiltrates a directory listing of /data/. Installing this package on a machine with cloud metadata reachability or CI secrets in the environment leaks IAM temporary credentials and environment secrets to a third-party attacker collector.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in zer0onetencent2 (npm)","id":"MAL-2026-10945","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":["0"],"last_affected":[],"package":"zer0onetencent2","purl":"pkg:npm/zer0onetencent2","source":"MAL-2026-10945"}],"products":null,"published":"2026-07-20","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-10945/"}