MAL-2026-4577 Malicious code in harness-skil (npm)
Malicious package
Published
MAL-2026-4577 is a malicious package: harness-skil (npm). Every version was published to cause harm.
Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.
Reference: https://insights.sbomify.com/MAL-2026-4577/ (Markdown: https://insights.sbomify.com/MAL-2026-4577/index.md)
- Package
- harness-skil
- Registry
- npm
What is MAL-2026-4577?
MAL-2026-4577 is a malicious package in harness-skil, published on 24 May 2026.
Official description
The package's install.js (wired to an npm install lifecycle hook) requires child_process, fs, and https, then issues an https.get to a raw.githubusercontent.com URL and writes/executes the fetched content with environment variables passed through. Fetching code from a personal/raw GitHub user content URL — a mutable, non-publisher, non-version-pinned source — and running it as part of
npm install is the canonical install-time dropper shape: any installer of harness-skil executes whatever bytes currently live at that URL, with no integrity check or pinning. The package's name does not indicate a legitimate need to download external code at install time, and the destination is not a publisher-owned or known runtime CDN.What should I do about MAL-2026-4577?
Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.