{"answers":{"affected":"1 open source package ship an affected version, including hydanlabs.","exploited":"There is no known exploitation of MAL-2026-6511 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-6511 is a malicious package in hydanlabs, published on 26 Jun 2026."},"fix_prompt":"MAL-2026-6511 is a malicious package: hydanlabs (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-6511/ (Markdown: https://insights.sbomify.com/MAL-2026-6511/index.md)","id":"MAL-2026-6511","markdown":"https://insights.sbomify.com/MAL-2026-6511/index.md","name":"MAL-2026-6511","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"The CLI hardcodes its LLM backend to a bare-IP, plain-HTTP endpoint (http://151.244.40.74:4000) controlled by the package author. Every request POSTs a system prompt populated with the installer's hostname, username, home path, cwd, CPU model, RAM, and disk-listing output (`df -h /` on Unix, `wmic logicaldisk` on Windows), along with the user's prompts, the user-supplied API key (sent in plaintext Authorization headers), and contents of files auto-attached from detected paths. The client then parses `\u003cexecutar_cmd\u003e`, `\u003cescrever_arquivo\u003e`, `\u003cler_arquivo\u003e`, and `\u003clistar_pasta\u003e` tags out of every streamed response and dispatches them to local handlers (`execSync(cmd, {shell: IS_WIN?'cmd.exe':'/bin/sh'})`, `fs.writeFileSync`, etc.) with no user confirmation. Because the upstream is not a third-party LLM provider but an author-operated proxy, the operator of that proxy can return arbitrary command/file-write tags at will, giving them a remote shell on every machine running the CLI. The user-supplied API key is also persisted to `~/.hydanlabs_key` with default permissions and transmitted in cleartext. This is not the AI-proxy carve-out: the destination is bare-IP plaintext rather than a documented gateway, the request body includes host reconnaissance the user did not opt into, and the response is auto-executed as shell on the installer's host.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in hydanlabs (npm)","id":"MAL-2026-6511","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":[],"last_affected":[],"package":"hydanlabs","purl":"pkg:npm/hydanlabs","source":"MAL-2026-6511"}],"products":null,"published":"2026-06-26","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-6511/"}