{"answers":{"affected":"1 open source package ship an affected version, including fhirproxy-utils.","exploited":"There is no known exploitation of MAL-2026-5461 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-5461 is a malicious package in fhirproxy-utils, published on 9 Jun 2026."},"fix_prompt":"MAL-2026-5461 is a malicious package: fhirproxy-utils (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-5461/ (Markdown: https://insights.sbomify.com/MAL-2026-5461/index.md)","id":"MAL-2026-5461","markdown":"https://insights.sbomify.com/MAL-2026-5461/index.md","name":"MAL-2026-5461","record":{"aliases":["GHSA-cw9q-6cmp-p38r"],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"On `npm install` (via the `prepare` lifecycle hook and many other lifecycle aliases) and on `require()`, index.js performs broad reconnaissance and exfiltration of the installer's environment. It collects hostname, username, architecture, working-directory tree, network interfaces, /etc/resolv.conf, process list,.git/HEAD, UID/GID, project package.json metadata, ~/.npmrc registry/scope configuration, the developer's git identity (via `git config --global user.email`), CI/CD environment variables (GITHUB_*, GITLAB_*, AWS_*, CIRCLE_*, etc.), and the presence of ~/.ssh, ~/.aws, ~/.kube. When running on a cloud instance it queries the IMDS endpoint at 169.254.169.254 (stored as the decimal-encoded host `2852039166`), obtains an IMDSv2 token, fetches the IAM role and temporary STS credentials, and includes the first 40 characters of the access token in the payload; equivalent paths exist for Azure and GCP metadata. It also performs DNS reconnaissance against internal-only hostnames (kubernetes.default.svc.cluster.local, vault.internal, consul.service.consul, gitlab.local, jenkins.local, redis.internal, etc.) to map the victim's internal network. Collected data is base64-encoded, fragmented, and exfiltrated via chunked HTTPS GET requests to `momo-rest.lapxa354.workers.dev` (a Cloudflare Workers C2 endpoint), with the destination obscured via `Buffer.from(\"bW9tby1yZXN0LmxhcHhhMzU0LndvcmtlcnMuZGV2\", \"base64\").toString()` at index.js:43. The package additionally squats common build-tool command names by declaring `bin` entries for webpack, vite, tsc/tsnode, jest, eslint, gulp, next, turbo, and prettier — all aliased to index.js — and spawns the real local tool (e.g. `webpack-cli`) afterwards to mask the malicious behavior when invoked via PATH or `npx`.\n\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in fhirproxy-utils (npm)","id":"MAL-2026-5461","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":["0"],"last_affected":[],"package":"fhirproxy-utils","purl":"pkg:npm/fhirproxy-utils","source":"MAL-2026-5461"}],"products":null,"published":"2026-06-09","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-5461/"}