# MAL-2026-4687: Malicious code in tempo-modules (npm)


- **Type:** Malicious package
- **Package:** `tempo-modules` (npm)
- **Published:** 25 May 2026

## What is MAL-2026-4687?

MAL-2026-4687 is a malicious package in tempo-modules, published on 25 May 2026. 

### Official description

tempo-modules@99.0.1 is a dependency-confusion attack package. The package.json preinstall hook executes poc.js, which on every `npm install` harvests hostname, username, full network configuration (ipconfig/ip a/resolv.conf), git remote, parent package.json, and CI pipeline definitions (.gitlab-ci.yml,.github/workflows, Jenkinsfile, azure-pipelines.yml), plus whoami/id output. It then iterates process.env and selects any key containing TOKEN, AWS, AZURE, NPM, GITHUB, GITLAB, CI, JENKINS, BUILD, WALMART, etc. — bulk credential scraping of cloud and CI tokens. The collected JSON is POSTed to https://d8a5d9pon5bugoc35cngp9hcregcqyezu.oast.me/<pkg> (an Interactsh out-of-band collector), with a hex-encoded host-user identifier additionally DNS-exfiltrated. The package is published at version 99.0.1 with an internal-sounding name to win dependency-confusion resolution against an organization's private registry; the description self-identifies as a 'Dependency Confusion PoC' for a bug-bounty program, but the published artifact harms any installer that resolves this name. Multiple independent block signals stack: lifecycle preinstall outbound exfil, bulk credential harvest of CI/cloud tokens, and dependency-confusion version inflation.

## What should I do about MAL-2026-4687?

Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.

## Fix prompt for AI coding agents

```text
MAL-2026-4687 is a malicious package: tempo-modules (npm). Every version was published to cause harm.

Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.

Reference: https://insights.sbomify.com/MAL-2026-4687/ (Markdown: https://insights.sbomify.com/MAL-2026-4687/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/MAL-2026-4687

---
From sbomify Insights: https://insights.sbomify.com/MAL-2026-4687/
Summaries are generated and may contain mistakes; the official description above is the record.