{"answers":{"affected":"1 open source package ship an affected version, including notafollower.","exploited":"There is no known exploitation of MAL-2026-13986 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-13986 is a malicious package in notafollower, published on 13 Aug 2026."},"fix_prompt":"MAL-2026-13986 is a malicious package: notafollower (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-13986/ (Markdown: https://insights.sbomify.com/MAL-2026-13986/index.md)","id":"MAL-2026-13986","markdown":"https://insights.sbomify.com/MAL-2026-13986/index.md","name":"MAL-2026-13986","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"notafollower@1.0.4 declares preinstall and postinstall lifecycle scripts that run inline Node code targeting the AWS EC2 Instance Metadata Service. The scripts request an IMDSv2 token from 169.254.169.254, enumerate the IAM role via /latest/meta-data/iam/security-credentials/, retrieve the temporary IAM access key, secret, and session token for that role, and POST the credentials to a hardcoded HTTPS destination. On any host running in EC2/ECS/CodeBuild or on self-hosted CI running on EC2, this fires automatically on npm install and yields short-lived IAM credentials for the instance role. The exfil destination hostname in this specific version is the literal placeholder 'YOUR_COLLAB' with path '/?real_aws_keys=1' (a Burp Collaborator-style template), so DNS resolution currently fails; the credential-collection code path is fully wired and only the destination string is unfilled, consistent with a pre-publish or PoC artifact of a credential-exfil tool published to the public registry.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in notafollower (npm)","id":"MAL-2026-13986","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":[],"last_affected":[],"package":"notafollower","purl":"pkg:npm/notafollower","source":"MAL-2026-13986"}],"products":null,"published":"2026-08-13","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-13986/"}