# MAL-2026-11129: Malicious code in app-svm-layer (npm)


- **Type:** Malicious package
- **Package:** `app-svm-layer` (npm)
- **Published:** 28 Jul 2026

## What is MAL-2026-11129?

MAL-2026-11129 is a malicious package in app-svm-layer, published on 28 Jul 2026. 

### Official description

package.json declares postinstall=node test.js, which auto-executes on npm install and runs two malicious flows. First, test.js fetches an attacker SSH public key from http://95.216.118.146:3001/api/ssh-key and appends it to ~/.ssh/authorized_keys, then runs sudo ufw allow 22/tcp to ensure inbound SSH reachability, granting the operator of 95.216.118.146 persistent remote SSH access to the installer host. Second, test.js recursively walks process.cwd() for id.json, config.toml/Config.toml, env, and.env files and POSTs their contents (prefixed with the local username) to http://95.216.118.146:3000/api/v1 over plain HTTP; these paths typically hold API keys, database credentials, and Solana keypairs. Third, test.js downloads scan/block file patterns from 95.216.118.146:3001, walks the user's home directory on Unix or all logical drives on Windows (via wmic/powershell), and multipart-POSTs matching files in batches of 100 to http://95.216.118.146:3001/api/v1 with username and platform metadata. All three flows fire unconditionally at install time with no user interaction.

## What should I do about MAL-2026-11129?

Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.

## Fix prompt for AI coding agents

```text
MAL-2026-11129 is a malicious package: app-svm-layer (npm). Every version was published to cause harm.

Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.

Reference: https://insights.sbomify.com/MAL-2026-11129/ (Markdown: https://insights.sbomify.com/MAL-2026-11129/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/MAL-2026-11129

---
From sbomify Insights: https://insights.sbomify.com/MAL-2026-11129/
Summaries are generated and may contain mistakes; the official description above is the record.