OpenSSF/OSV advisory MAL-2026-14059 confirms this npm version as malicious. On `npm install`, preinstall.js enumerates process.env for keys matching credential substrings (KEY, SECRET, TOKEN, PASSWORD, AWS, API, CREDENTIAL, AUTH, PRIVATE, NPM, GIT, GITHUB, GITLAB), reads the working directory's.env and package.json, runs `git remote -v`, and POSTs the collected data via https to a hardcoded webhook.site collector (https://webhook.site/34e76ae9-12e2-4fea-a33a-24f4e1ac5eb2)...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in autbank-core (npm)
Details
On `npm install`, preinstall.js enumerates process.env for keys matching credential substrings (KEY, SECRET, TOKEN, PASSWORD, AWS, API, CREDENTIAL, AUTH, PRIVATE, NPM, GIT, GITHUB, GITLAB), reads the working directory's.env and package.json, runs `git remote -v`, and POSTs the collected data via https to a hardcoded webhook.site collector (https://webhook.site/34e76ae9-12e2-4fea-a33a-24f4e1ac5eb2). A companion postinstall.js labeled internally as 'backup exfil' POSTs os.hostname(), os.userInfo().username, and process.cwd() to the same endpoint. Both lifecycle hooks fire automatically on default install, with no relationship to any advertised package functionality.
Decision reason
OpenSSF Malicious Packages via OSV confirms autbank-core@99.0.0 as malicious (MAL-2026-14059): Malicious code in autbank-core (npm)