{"answers":{"affected":"1 open source package ship an affected version, including hunsterx-package.","exploited":"There is no known exploitation of MAL-2026-6337 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-6337 is a malicious package in hunsterx-package, published on 23 Jun 2026."},"fix_prompt":"MAL-2026-6337 is a malicious package: hunsterx-package (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-6337/ (Markdown: https://insights.sbomify.com/MAL-2026-6337/index.md)","id":"MAL-2026-6337","markdown":"https://insights.sbomify.com/MAL-2026-6337/index.md","name":"MAL-2026-6337","record":{"aliases":["GHSA-29mh-6rgm-mmfw"],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"preinstall.js executes a chain of eval(Buffer.from('\u003cbase64\u003e','base64').toString()) payloads at npm install time. The decoded payloads collect host identity (os.hostname, os.userInfo, cwd, network interfaces), the full process.env (chunked over DNS if larger than 5KB), the contents of./.npmrc and ~/.npmrc, AWS EC2 instance-identity metadata fetched from IMDSv2 at 169.254.169.254 (account ID, region), and recursive reads of *.env / *.config / *.yaml / *.toml files in the working directory. All collected data is transmitted via https.get and dns.resolve to d8rqs6ri6i9md1fcfdpgirhdcr17idqdh.oast.fun (a project-discovery Interactsh out-of-band collaborator). postinstall.js additionally performs a DNS callback `postinstall-\u003crand\u003e.d8rqs6ri6i9md1fcfdpgirhdcr17idqdh.oast.fun` to confirm both lifecycle phases ran. The base64+eval wrapping has no functional purpose other than evading static review. Installer impact: any developer or CI runner that performs `npm install` on this package leaks npm publish tokens (from.npmrc), full environment variables (commonly containing API keys, cloud credentials, and CI secrets), and AWS account/region identifiers to the attacker.\n\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in hunsterx-package (npm)","id":"MAL-2026-6337","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":["0"],"last_affected":[],"package":"hunsterx-package","purl":"pkg:npm/hunsterx-package","source":"MAL-2026-6337"}],"products":null,"published":"2026-06-23","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-6337/"}