{"answers":{"affected":"1 open source package ship an affected version, including @galicia-toolkit-nestjs-20-lite/paas.","exploited":"There is no known exploitation of MAL-2026-17730 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-17730 is a malicious package in @galicia-toolkit-nestjs-20-lite/paas, published on 9 Oct 2026."},"fix_prompt":"MAL-2026-17730 is a malicious package: @galicia-toolkit-nestjs-20-lite/paas (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-17730/ (Markdown: https://insights.sbomify.com/MAL-2026-17730/index.md)","id":"MAL-2026-17730","markdown":"https://insights.sbomify.com/MAL-2026-17730/index.md","name":"MAL-2026-17730","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"@galicia-toolkit-nestjs-20-lite/paas is a dependency confusion package published to npm on 2026-10-09 by the account s4yhii__, targeting the internal @galicia-toolkit-* / @brick-v2 package namespaces with inflated versions (e.g. 999.0.x). Early versions resolve \u003chostname\u003e.\u003ctag\u003e.dc.oob.s4yhii.com via DNS to beacon the victim's hostname. Later versions run `node index.js` from a preinstall hook, which loads a bundled native addon (prebuilds/\u003cplatform\u003e-\u003carch\u003e/metrics.node, Linux and Windows builds). The addon forks a detached process that collects hostname, username, OS/arch, cwd and the full values of CI/cloud secrets from environment variables (NPM_TOKEN, NODE_AUTH_TOKEN, GITHUB_TOKEN, ACTIONS_RUNTIME_TOKEN, ACTIONS_ID_TOKEN_REQUEST_TOKEN, AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN, SYSTEM_ACCESSTOKEN, AZURE_DEVOPS_EXT_PAT and others) and sends them as JSON via HTTP POST /native to oob.s4yhii.com:9999.\n\nThe package declares scripts.preinstall `node index.js || true`, and index.js (also the main entry) require()s a platform-specific prebuilt native addon at prebuilds/\u003cplatform\u003e-\u003carch\u003e/metrics.node. The native binary reads a curated list of CI/cloud credential environment variables (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN, GITHUB_TOKEN, NPM_TOKEN, NODE_AUTH_TOKEN, SYSTEM_ACCESSTOKEN, ACTIONS_RUNTIME_TOKEN, ACTIONS_ID_TOKEN_REQUEST_TOKEN, AZURE_DEVOPS_EXT_PAT, and similar), together with hostname, user, OS/arch, and cwd (gethostname/getpwuid/uname/getcwd on Linux; GetUserNameA/GetComputerNameA/GetCurrentDirectoryA on Windows). The collected values are serialized as a JSON body (`{\"src\":\"native\",\"pkg\":...,\"e\":{...}}`) and sent via a raw TCP socket as `POST /native HTTP/1.0` to the hardcoded host oob.s4yhii.com. The exported NestJS surface (forRoot/createLogger) is empty stub code with no real functionality, and a nested manifest at src/archetype/package.json contains the self-identifying marker `s4yhii-poc-2026-10-09` and contact `jesusitpro22@gmail.com`, matching the exfil host. The harmful code path fires automatically on `npm install` via preinstall and again on any require() of the package.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in @galicia-toolkit-nestjs-20-lite/paas (npm)","id":"MAL-2026-17730","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":["0"],"last_affected":[],"package":"@galicia-toolkit-nestjs-20-lite/paas","purl":"pkg:npm/%40galicia-toolkit-nestjs-20-lite/paas","source":"MAL-2026-17730"}],"products":null,"published":"2026-10-09","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-17730/"}