{"answers":{"affected":"1 open source package ship an affected version, including glob-helper.","exploited":"There is no known exploitation of MAL-2026-3764 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-3764 is a malicious package in glob-helper, published on 14 May 2026."},"fix_prompt":"MAL-2026-3764 is a malicious package: glob-helper (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-3764/ (Markdown: https://insights.sbomify.com/MAL-2026-3764/index.md)","id":"MAL-2026-3764","markdown":"https://insights.sbomify.com/MAL-2026-3764/index.md","name":"MAL-2026-3764","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"glob-helper@1.0.2 is a malicious typosquat with no legitimate functionality. Its index.js is a stub; package.json declares `scripts.postinstall: node postinstall.js`, which fires automatically on `npm install`. postinstall.js performs three concurrent credential-theft operations and POSTs the results as JSON over plain HTTP to a hardcoded bare-IP C2 at http://149.28.127.35:8888:\n\n1. Reads ~/.npmrc (extracting _authToken and npm_* tokens), ~/.env (regex-matching NPM_TOKEN, NPM_AUTH_TOKEN, AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, GITHUB_TOKEN), and ~/.git-credentials.\n2. Enumerates Chrome/Brave/Edge/Chromium/Vivaldi/Opera profile directories under ~/.config/*, walks `Local Extension Settings/\u003cwalletId\u003e` for a hardcoded list of 71 crypto-wallet extension IDs (MetaMask `nkbihfbeogaeaoehlefnkodbefgpgknn`, Phantom, Coinbase, Trust, Ledger Live, Trezor, etc.), and greps log contents for `vault`, `seed`, `mnemonic`, `privateKey`, `password`, `encrypted`.\n3. Walks ~/Documents, ~/Desktop, ~/Downloads for files whose names match `seed|backup|wallet|phrase|metamask|phantom|vault|key|private`, opens each, counts BIP39 wordlist matches, and includes file path + content preview in the exfil payload when 8+ BIP39 words are present.\n\nThe package.json keywords list `lodash` and the description is `Glob Helper utility helpers`, but index.js contains the author's own comment `lodash-js — Just a dummy module. The real payload is in postinstall.js`. Installing this package on any developer or CI machine leaks npm publish tokens, AWS keys, GitHub tokens, browser-stored wallet data, and any cryptocurrency seed backups present in the user's home directories.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in glob-helper (npm)","id":"MAL-2026-3764","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":[],"last_affected":[],"package":"glob-helper","purl":"pkg:npm/glob-helper","source":"MAL-2026-3764"}],"products":null,"published":"2026-05-14","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-3764/"}