# MAL-2026-6674: Malicious code in ripshakti1 (npm)


- **Type:** Malicious package
- **Package:** `ripshakti1` (npm)
- **Published:** 30 Jun 2026

## What is MAL-2026-6674?

MAL-2026-6674 is a malicious package in ripshakti1, published on 30 Jun 2026. 

### Official description

package.json declares a preinstall lifecycle hook (`node index.js`) that auto-executes on `npm install`. index.js queries the AWS EC2 instance metadata service (IMDSv2 and v1) at 169.254.169.254 for IAM role credentials, instance identity, user-data, and network/host metadata, queries the ECS task credentials endpoint at 169.254.170.2, and filters process.env for keys matching secret-shaped patterns (key, secret, token, pass, auth, cred, api, aws, database, db_, mongo, redis, s3, sqs, sns, lambda, role). Each payload is base64-encoded and exfiltrated via HTTPS GET to the attacker-controlled Burp Collaborator subdomain a2de2lw03amqkgbex432znqb72du1kp9.oastify.com. This auto-fires on every install, including transitive installs and CI runners.

The OpenSSF Package Analysis project identified 'ripshakti1' @ 81.0.0 (npm) as malicious.

It is considered malicious because:

- The package communicates with a domain associated with malicious activity.

## What should I do about MAL-2026-6674?

Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.

## Fix prompt for AI coding agents

```text
MAL-2026-6674 is a malicious package: ripshakti1 (npm). Every version was published to cause harm.

Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.

Reference: https://insights.sbomify.com/MAL-2026-6674/ (Markdown: https://insights.sbomify.com/MAL-2026-6674/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/MAL-2026-6674

---
From sbomify Insights: https://insights.sbomify.com/MAL-2026-6674/
Summaries are generated and may contain mistakes; the official description above is the record.