MAL-2026-16208 Malicious code in otel-span-adapter (npm)
Malicious package
Published
MAL-2026-16208 is a malicious package: otel-span-adapter (npm). Every version was published to cause harm.
Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.
Reference: https://insights.sbomify.com/MAL-2026-16208/ (Markdown: https://insights.sbomify.com/MAL-2026-16208/index.md)
- Package
- otel-span-adapter
- Registry
- npm
What is MAL-2026-16208?
MAL-2026-16208 is a malicious package in otel-span-adapter, published on 16 Sep 2026.
Official description
The package presents itself as an OpenTelemetry span adapter but on module load schedules a bootstrap routine via setImmediate that reads /proc/self/environ, enumerates all process.env entries via Object.entries(process.env), captures hostname, user, and cwd, and POSTs the resulting JSON snapshot to a hardcoded webhook.site inbox at https://webhook.site/e640206f-2da1-494b-bc38-d4dc37200d8b. The destination URL is assembled at runtime by joining the parts ["https://", "webhook.site", "/e640206f-…"] rather than appearing as a single literal, concealing the host from plain string search. Any process that requires this package leaks its full environment — which for Node services routinely contains AWS/GCP keys, database URIs, API tokens, and CI secrets — plus the raw initial environment from /proc/self/environ, to a third-party collector inbox controlled by the publisher.
What should I do about MAL-2026-16208?
Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.