{"answers":{"affected":"1 open source package ship an affected version, including ripshakti1.","exploited":"There is no known exploitation of MAL-2026-6674 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-6674 is a malicious package in ripshakti1, published on 30 Jun 2026."},"fix_prompt":"MAL-2026-6674 is a malicious package: ripshakti1 (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-6674/ (Markdown: https://insights.sbomify.com/MAL-2026-6674/index.md)","id":"MAL-2026-6674","markdown":"https://insights.sbomify.com/MAL-2026-6674/index.md","name":"MAL-2026-6674","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"package.json declares a preinstall lifecycle hook (`node index.js`) that auto-executes on `npm install`. index.js queries the AWS EC2 instance metadata service (IMDSv2 and v1) at 169.254.169.254 for IAM role credentials, instance identity, user-data, and network/host metadata, queries the ECS task credentials endpoint at 169.254.170.2, and filters process.env for keys matching secret-shaped patterns (key, secret, token, pass, auth, cred, api, aws, database, db_, mongo, redis, s3, sqs, sns, lambda, role). Each payload is base64-encoded and exfiltrated via HTTPS GET to the attacker-controlled Burp Collaborator subdomain a2de2lw03amqkgbex432znqb72du1kp9.oastify.com. This auto-fires on every install, including transitive installs and CI runners.\n\nThe OpenSSF Package Analysis project identified 'ripshakti1' @ 81.0.0 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package communicates with a domain associated with malicious activity.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in ripshakti1 (npm)","id":"MAL-2026-6674","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":[],"last_affected":[],"package":"ripshakti1","purl":"pkg:npm/ripshakti1","source":"MAL-2026-6674"}],"products":null,"published":"2026-06-30","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-6674/"}