# MAL-2026-13484: Malicious code in merge-grid-stats (npm)


- **Type:** Malicious package
- **Package:** `merge-grid-stats` (npm)
- **Published:** 6 Aug 2026

## What is MAL-2026-13484?

MAL-2026-13484 is a malicious package in merge-grid-stats, published on 6 Aug 2026. 

### Official description

Package advertises itself as a 2048-style grid game statistics utility, but its declared postinstall hook (`node install-cb.js`) executes on `npm install` and performs behavior unrelated to that purpose. The postinstall shells out via execSync to run `uname -a` and `id`, reads `/proc/1/cgroup` and `/proc/mounts`, inspects Linux capabilities, checks for `/var/run/docker.sock`, and reads the Kubernetes service-account token and namespace at `/var/run/secrets/kubernetes.io/serviceaccount/`. It also enumerates `/`, `/root`, `/root/projects`, performs a host write-test, inspects network configuration, and greps the process environment for variables matching `token|secret|key|password|db_|redis|s3` and related patterns. The collected data (including the k8s SA token length and env keys) is written to `NCODE_ESCAPE.txt` in the current working directory and two parent directories. Author metadata is placeholder-shaped (`merge-tools <merge-tools@example.com>`) and the README/behavior mismatch indicates a cover-story shape. The install-time read of an installer-owned Kubernetes service-account token plus environment secret enumeration constitutes installer-side credential access and container-escape reconnaissance staging.

## What should I do about MAL-2026-13484?

Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.

## Fix prompt for AI coding agents

```text
MAL-2026-13484 is a malicious package: merge-grid-stats (npm). Every version was published to cause harm.

Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.

Reference: https://insights.sbomify.com/MAL-2026-13484/ (Markdown: https://insights.sbomify.com/MAL-2026-13484/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/MAL-2026-13484

---
From sbomify Insights: https://insights.sbomify.com/MAL-2026-13484/
Summaries are generated and may contain mistakes; the official description above is the record.