MAL-2026-5899 Malicious code in stripe-cli-init-plugin (npm)
Malicious package
Published
MAL-2026-5899 is a malicious package: stripe-cli-init-plugin (npm). Every version was published to cause harm.
Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.
Reference: https://insights.sbomify.com/MAL-2026-5899/ (Markdown: https://insights.sbomify.com/MAL-2026-5899/index.md)
- Package
- stripe-cli-init-plugin
- Registry
- npm
What is MAL-2026-5899?
MAL-2026-5899 is a malicious package in stripe-cli-init-plugin, published on 16 Jun 2026.
Official description
Package name 'stripe-cli-init-plugin' impersonates the Stripe CLI ecosystem and ships a bin script (bin/run.js) that, when invoked via
npx stripe-cli-init-plugin or as the installed CLI, POSTs the installer's project directory basename and a timestamp to a hardcoded remote URL (https://deepbounty.dd06-dev.fr/cb/10306845-ff21-4176-8574-95dd4917bc45). The package self-describes as a 'Security PoC for Bug Bounty' but is published to the public npm registry under a name designed to be reached via typo or autocomplete confusion against the legitimate Stripe CLI tooling, and provides no advertised functionality — its only effect on the installer is to confirm execution and leak the CWD basename to the author's server. The combination of name-confusion targeting a top-tier brand plus a silent phone-home to an attacker-controlled endpoint constitutes a supply-chain attack regardless of the author's stated intent.What should I do about MAL-2026-5899?
Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.