MAL-2026-18359 Malicious code in black-spindle (npm)

[email protected] declares a postinstall lifecycle hook in package.json that executes curl http://778e-181-63-25-28.ngrok-free.app/test on every npm install. The destination is a short-lived, anonymous ngrok-free.app HTTPS/HTTP tunnel unrelated to any declared publisher, contacted over plain HTTP with no pinning or verification. The shipped index.js is an empty stub, so the manifest's lifecycle hook is the package's entire effect: installing the package causes the installer's host to contact an attacker-controlled endpoint and discloses install-time metadata (source IP, timing, user-agent) to that endpoint. The 999.0.0 version and single-line postinstall-beacon shape are consistent with dependency-confusion / install-telemetry beaconing rather than a legitimate library.

The OpenSSF Package Analysis project identified 'black-spindle' @ 999.0.0 (npm) as malicious.

It is considered malicious because:

• The package communicates with a domain associated with malicious activity.

• The package executes one or more commands associated with malicious behavior.