MAL-2026-15907 Malicious code in tiny-folder-tree (npm)
Malicious package
Published
MAL-2026-15907 is a malicious package: tiny-folder-tree (npm). Every version was published to cause harm.
Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.
Reference: https://insights.sbomify.com/MAL-2026-15907/ (Markdown: https://insights.sbomify.com/MAL-2026-15907/index.md)
- Package
- tiny-folder-tree
- Registry
- npm
What is MAL-2026-15907?
MAL-2026-15907 is a malicious package in tiny-folder-tree, published on 4 Sep 2026.
Official description
[email protected] declares a postinstall script (src/build.js) that runs on
npm install. The script performs a DNS TXT lookup for spreadsheets-documents.com and, when the first character of the first TXT record is '1', invokes src/tools.js which issues an HTTPS request to a URL reconstructed at runtime from obfuscated numeric constants in src/const.js (base-77/base-45 encoded strings decoding to 'https' and an 'HTTPS://…' URL). The response's 'm' header is passed directly to child_process.execSync, yielding arbitrary attacker-controlled shell execution on the installer's machine. The require target for the HTTPS module and the destination URL are both reconstructed via helpers (normalize_hash / normalize_hash_map) to evade static analysis. An author-username bypass ('justin') skips execution on the author's own host, confirming the code is intended to fire on other installers rather than the maintainer.What should I do about MAL-2026-15907?
Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.