MAL-2026-11043 Malicious code in supplyhub (npm)

The npm package supplyhub is a credential / SSH-key stealer. Its package.json declares a postinstall lifecycle hook (postinstall: node postinstall.js) that executes automatically on npm install, before the package is ever imported.

postinstall.js uses fs.readFileSync to read the user's SSH private key (~/.ssh/id_rsa) and the process environment (/proc/self/environ — where CI/cloud tokens and npm tokens live), and gathers account/host identity via os.userInfo(); it also references /etc/passwd. The collected data is exfiltrated by HTTP POST to a hard-coded webhook.site dead-drop: https://webhook.site/3c9418b3-cacd-403d-b42e-e9e4a9508fe3.

Only version 1.0.2 is malicious: version 1.0.0 (held in the codelake corpus) is clean — the exfiltration code was introduced in the 1.0.2 release (a trust-then-poison pattern). Any workstation or CI runner that installs [email protected] (directly or transitively) hands its SSH key and environment secrets to the operator.

[email protected] ships a postinstall.js that runs automatically on npm install and collects installer host identifiers (os.hostname(), os.userInfo().username, process.cwd(), pid, platform, arch, node version) along with CI-related environment variables (CI, RENOVATE_VERSION), then transmits them as query parameters to a hardcoded webhook.site endpoint (https://webhook.site/3c9418b3-cacd-403d-b42e-e9e4a9508fe3) using https.get with http and execSync('curl…' || wget…) fallbacks. The package.json description self-labels this as a dependency-confusion PoC targeting the 'Travix supplyhub' name, but the tarball is published to public npm and will execute the install-time beacon against any installer that resolves this name, including unrelated users who typo or whose internal builds dependency-confuse into it.