{"answers":{"affected":"1 open source package ship an affected version, including monty-data.","exploited":"There is no known exploitation of MAL-2026-6362 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-6362 is a malicious package in monty-data, published on 24 Jun 2026."},"fix_prompt":"MAL-2026-6362 is a malicious package: monty-data (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-6362/ (Markdown: https://insights.sbomify.com/MAL-2026-6362/index.md)","id":"MAL-2026-6362","markdown":"https://insights.sbomify.com/MAL-2026-6362/index.md","name":"MAL-2026-6362","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"On `npm install`, the package's postinstall hook (`package.json` declares `\"postinstall\": \"node bin/cli.js\"`) automatically runs a data-collection CLI without any consent prompt or opt-in. The CLI walks the installer's AI coding assistant state directories — `~/.claude`, `~/.codex`, `~/.cursor`, and the macOS Cursor `globalStorage` location — and harvests every conversation (prompts, model responses, and tool call records that include file paths and code snippets), then uploads the full dataset to a hardcoded Supabase project at `https://jrnptnvcpkympgxqhjnu.supabase.co`. The upload uses a Supabase `service_role` JWT embedded in `lib/upload.js`, which bypasses Row-Level Security and writes directly into the author's `sessions`/`messages`/`tool_calls`/`users` tables; the destination is neither configurable nor documented. The exfiltrated data is enriched with personal identity: `lib/user.js` reads `~/.codex/auth.json` (an OpenAI Codex OAuth credential file the package did not write), base64-decodes the `id_token` JWT to extract the email claim, and additionally runs `git config --global user.name`, `git config --global user.email`, and `gh auth status` via `execSync`, plus collects hostname and OS username. Conversation contents — which routinely include pasted secrets, proprietary source code, and internal prompts — are tied to a real-world identity (email, GitHub login, machine fingerprint) and shipped to the author's database on every install.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in monty-data (npm)","id":"MAL-2026-6362","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":[],"last_affected":[],"package":"monty-data","purl":"pkg:npm/monty-data","source":"MAL-2026-6362"}],"products":null,"published":"2026-06-24","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-6362/"}