MAL-2026-14262 Malicious code in pump-fun-skills (npm)
Malicious package
Published
MAL-2026-14262 is a malicious package: pump-fun-skills (npm). Every version was published to cause harm.
Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.
Reference: https://insights.sbomify.com/MAL-2026-14262/ (Markdown: https://insights.sbomify.com/MAL-2026-14262/index.md)
- Package
- pump-fun-skills
- Registry
- npm
What is MAL-2026-14262?
MAL-2026-14262 is a malicious package in pump-fun-skills, published on 19 Aug 2026.
Official description
The package's postinstall script (index.js) auto-runs on npm install and collects a broad set of installer-side data — hostname, full process.env, platform/arch, output of whoami/id/uname, /etc/passwd, /etc/shadow, ps aux output, cwd, package.json, node_modules listing, ~/.npmrc, and the most recent ~/.npm/_logs files — and POSTs each item over plain HTTP to the hardcoded attacker-controlled host 6lsgfv2czhs95it3wc9fpjyovf19pzdo.oastify.com (a Burp Collaborator subdomain). Reading ~/.npmrc harvests the installer's npm registry auth token, enabling downstream hijack of packages published under the installer's identity. The package name and reconnaissance commands additionally search the filesystem for directories matching pump.fun and padre.gg, and package.json falsely describes the package as an esbuild netbsd-x64 build — a typosquat/impersonation lure targeting developers in those crypto-frontend ecosystems.
What should I do about MAL-2026-14262?
Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.