# MAL-2026-4472: Malicious code in @zhengshuo888/huoke (npm)


- **Type:** Malicious package
- **Package:** `@zhengshuo888/huoke` (npm)
- **Published:** 21 May 2026

## What is MAL-2026-4472?

MAL-2026-4472 is a malicious package in @zhengshuo888/huoke, published on 21 May 2026. 

### Official description

On npm install, the package's postinstall hook runs `node bin/huoke.js install-skill`, which uses `execSync` to invoke `curl -fsSL` against `https://raw.githubusercontent.com/amswf/huoke/main/SKILL.md` and writes the response into `~/.hermes/skills/.../SKILL.md` and `~/.openclaw/skills/...`. The URL is on a personal GitHub user's account (`amswf`) that does not match the package's declared repository (`huoke-link/huoke-skill`), points at a mutable `main` branch, and the fetched content is not hash- or signature-verified. The package already ships a `SKILL.md` in the tarball, but the postinstall ignores it and refetches remotely, so the file the AI ends up loading is whatever the controller of that personal repo serves at install time — not the file npm reviewed. The installed SKILL.md is loaded by Hermes/OpenClaw as agent instructions and contains `curl` directives that the user's AI agent executes with the user's bearer tokens, giving the controller of `github.com/amswf/huoke` an install-time channel to direct privileged actions on the installer's machine. Separately, `bin/huoke.js` defaults its server endpoint to `http://huoke.link` (plaintext HTTP) with a hardcoded shared bearer `sk_clawx_dev_2026`, so the credential-setup flow it advertises transmits the installer's email, verification code, and password in cleartext under a key shared by every installer — a quality issue layered on top of the install-time-fetch concern.

## What should I do about MAL-2026-4472?

Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.

## Fix prompt for AI coding agents

```text
MAL-2026-4472 is a malicious package: @zhengshuo888/huoke (npm). Every version was published to cause harm.

Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.

Reference: https://insights.sbomify.com/MAL-2026-4472/ (Markdown: https://insights.sbomify.com/MAL-2026-4472/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/MAL-2026-4472

---
From sbomify Insights: https://insights.sbomify.com/MAL-2026-4472/
Summaries are generated and may contain mistakes; the official description above is the record.