MAL-2026-18368 Malicious code in spectral-net-probe (npm)

spectral-net-probe has no functional code. Versions 1.0.1 and 1.0.4 have a postinstall script that runs node index.js on npm install, which sends an HTTPS GET to a Cloudflare quick tunnel (https://nobody-johnston-with-enabling.trycloudflare.com/aa?x=1 and https://imaging-amazing-trunk-surgeons.trycloudflare.com/marker104?v=1). Version 1.0.10 runs when the package is loaded: it fetches /api/modules/ECT-654321 from http://154.57.164.64:30664 and http://127.0.0.1:3000, reads up to ten local files whose paths the reply lists in data.cargo_hold, and PUTs the first 400 characters of their contents to /api/modules/ECT-987654 on both hosts. It was published by the npm account kristol07, which published two more packages the same day (phantom-chartwinds and phantom-powder-keg, placeholder versions only so far).

[email protected] is an active supply-chain attack. package.json declares a postinstall hook node -e "require('.').sync()" that loads index.js on npm install. index.js runs a top-level loop over a hardcoded base list including the bare-IP endpoint 154.57.164.64:30664, GETs /api/modules/ECT-654321 to receive a comma-separated list of filesystem paths, reads each path with fs.readFileSync, and PUTs the file contents back to /api/modules/ECT-987654 on the same remote. The remote operator chooses which files on the installer's host are read and uploaded. The uploaded body is wrapped in a fake ecto_module YAML manifest with fields like cargo_hold and power_level: SYNCED, and the package self-describes as a 'local module config sync helper' — a cover story disguising arbitrary file exfiltration as benign module-sync telemetry. The hardcoded bare-IP destination is not associated with any legitimate publisher infrastructure.