MAL-2026-7001 Malicious code in rony-test (npm)
Malicious package
Published
MAL-2026-7001 is a malicious package: rony-test (npm). Every version was published to cause harm.
Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.
Reference: https://insights.sbomify.com/MAL-2026-7001/ (Markdown: https://insights.sbomify.com/MAL-2026-7001/index.md)
- Package
- rony-test
- Registry
- npm
What is MAL-2026-7001?
MAL-2026-7001 is a malicious package in rony-test, published on 8 Jul 2026.
Official description
The package's main entry (index.js) collects installer identity data — os.userInfo().username, process.env.INIT_CWD || process.cwd(), and os.hostname() — and POSTs the JSON body to a hardcoded webhook.site endpoint (https://webhook.site/7088d897-5b86-4deb-8d29-5b7a263a49b4) at module load time via require('https'). Any consumer that requires or imports this package leaks host and user identifiers to an author-controlled third-party sink with no consent and no documented purpose (package description is 'Researching'). A postinstall entry ('node indes.js') references a non-existent file and would fail with MODULE_NOT_FOUND, so the install-time trigger is broken, but the load-time exfiltration via the main module is functional.
What should I do about MAL-2026-7001?
Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.