# MAL-2026-16223: Malicious code in @traktis/environment (npm)


- **Type:** Malicious package
- **Package:** `@traktis/environment` (npm)
- **Published:** 16 Sep 2026

## What is MAL-2026-16223?

MAL-2026-16223 is a malicious package in @traktis/environment, published on 16 Sep 2026. 

### Official description

package.json declares preinstall and postinstall lifecycle scripts that invoke curl against the hardcoded cleartext endpoint http://tko.amgsec.com/depconf/traktis-environment/, sending the output of whoami, hostname, cwd, a timestamp, and a base64-encoded dump of CI/build environment variables matched by the pattern GITHUB_*, CI_PROJECT, JENKINS_URL, BUILD_URL, GITLAB_*, RUNNER_*, HOSTNAME, USER, HOME as query parameters. index.js is a 55-byte placeholder comment and author is listed as 'anonymous'; the manifest lifecycle scripts are the entire functional payload. The name occupies the @traktis scope at version 99.99.2, a version-inflation shape consistent with dependency-confusion resolution against an internal package of the same name. Installing the package on any developer workstation or CI runner automatically transmits build-system identity and any credential-shaped environment variables covered by the grep pattern to a third-party host over plain HTTP.

## What should I do about MAL-2026-16223?

Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.

## Fix prompt for AI coding agents

```text
MAL-2026-16223 is a malicious package: @traktis/environment (npm). Every version was published to cause harm.

Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.

Reference: https://insights.sbomify.com/MAL-2026-16223/ (Markdown: https://insights.sbomify.com/MAL-2026-16223/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/MAL-2026-16223

---
From sbomify Insights: https://insights.sbomify.com/MAL-2026-16223/
Summaries are generated and may contain mistakes; the official description above is the record.