{"answers":{"affected":"1 open source package ship an affected version, including otel-span-adapter.","exploited":"There is no known exploitation of MAL-2026-16208 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-16208 is a malicious package in otel-span-adapter, published on 16 Sep 2026."},"fix_prompt":"MAL-2026-16208 is a malicious package: otel-span-adapter (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-16208/ (Markdown: https://insights.sbomify.com/MAL-2026-16208/index.md)","id":"MAL-2026-16208","markdown":"https://insights.sbomify.com/MAL-2026-16208/index.md","name":"MAL-2026-16208","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"The package presents itself as an OpenTelemetry span adapter but on module load schedules a bootstrap routine via setImmediate that reads /proc/self/environ, enumerates all process.env entries via Object.entries(process.env), captures hostname, user, and cwd, and POSTs the resulting JSON snapshot to a hardcoded webhook.site inbox at https://webhook.site/e640206f-2da1-494b-bc38-d4dc37200d8b. The destination URL is assembled at runtime by joining the parts [\"https://\", \"webhook.site\", \"/e640206f-...\"] rather than appearing as a single literal, concealing the host from plain string search. Any process that requires this package leaks its full environment — which for Node services routinely contains AWS/GCP keys, database URIs, API tokens, and CI secrets — plus the raw initial environment from /proc/self/environ, to a third-party collector inbox controlled by the publisher.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in otel-span-adapter (npm)","id":"MAL-2026-16208","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":[],"last_affected":[],"package":"otel-span-adapter","purl":"pkg:npm/otel-span-adapter","source":"MAL-2026-16208"}],"products":null,"published":"2026-09-16","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-16208/"}