merge-grid-stats@1.2.0: Malicious npm security report (Block)

OSV Malicious Advisory

scanned 8d ago · by OpenSSF/OSV

OpenSSF/OSV advisory MAL-2026-13484 confirms this npm version as malicious. Package advertises itself as a 2048-style grid game statistics utility, but its declared postinstall hook (`node install-cb.js`) executes on `npm install` and performs behavior unrelated to that purpose. The postinstall shells out via execSync to run `uname -a` and `id`, reads `/proc/1/cgroup` and `/proc/mounts`, inspects Linux capabilities, checks for `/var/run/docker.sock`, and reads the Kubernetes service-account...

Advisory

MAL-2026-13484

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in merge-grid-stats (npm)

Details

Package advertises itself as a 2048-style grid game statistics utility, but its declared postinstall hook (`node install-cb.js`) executes on `npm install` and performs behavior unrelated to that purpose. The postinstall shells out via execSync to run `uname -a` and `id`, reads `/proc/1/cgroup` and `/proc/mounts`, inspects Linux capabilities, checks for `/var/run/docker.sock`, and reads the Kubernetes service-account token and namespace at `/var/run/secrets/kubernetes.io/serviceaccount/`. It also enumerates `/`, `/root`, `/root/projects`, performs a host write-test, inspects network configuration, and greps the process environment for variables matching `token|secret|key|password|db_|redis|s3` and related patterns. The collected data (including the k8s SA token length and env keys) is written to `NCODE_ESCAPE.txt` in the current working directory and two parent directories. Author metadata is placeholder-shaped (`merge-tools <merge-tools@example.com>`) and the README/behavior mismatch indicates a cover-story shape. The install-time read of an installer-owned Kubernetes service-account token plus environment secret enumeration constitutes installer-side credential access and container-escape reconnaissance staging.

Decision reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

References

OSV advisory PACKAGE PACKAGE

Decision evidence

public snapshot

Behavioral surface

Source

FilesystemNetwork

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 2.69 KB of source

Source & flagged code

3 flagged

package.jsonView file

•scripts.postinstall = node install-cb.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

install-cb.jsView file

3var path = require('path'); L4: var http = require('http'); L5: var os = require('os'); L6: L7: var cwd = process.cwd(); L8: var lines = ['meta-probe', 'cwd=' + cwd, 'host=' + (function(){try{return os.hostname();}catch(e){return '?';}})()]; L9: ... L20: req.on('error', function (e) { if (!done) { done = true; resolve('ERR:' + (e.code || 'conn')); } }); L21: req.end(); L22: } catch (e) {

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

install-cb.jsView on unpkg · L3

•matchType = previous_version_dangerous_delta matchedPackage = merge-grid-stats@1.1.0 matchedIdentity = npm:bWVyZ2UtZ3JpZC1zdGF0cw:1.1.0 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

install-cb.jsView on unpkg

Source & flagged code

3 flagged · loading source

package.jsonView file

•scripts.postinstall = node install-cb.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

install-cb.jsView file

3var path = require('path'); L4: var http = require('http'); L5: var os = require('os'); L6: L7: var cwd = process.cwd(); L8: var lines = ['meta-probe', 'cwd=' + cwd, 'host=' + (function(){try{return os.hostname();}catch(e){return '?';}})()]; L9: ... L20: req.on('error', function (e) { if (!done) { done = true; resolve('ERR:' + (e.code || 'conn')); } }); L21: req.end(); L22: } catch (e) {

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

install-cb.jsView on unpkg · L3

•matchType = previous_version_dangerous_delta matchedPackage = merge-grid-stats@1.1.0 matchedIdentity = npm:bWVyZ2UtZ3JpZC1zdGF0cw:1.1.0 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

Findings

3 High1 Medium2 Low

HighInstall Time Lifecycle Scriptspackage.json

HighCloud Metadata Accessinstall-cb.js

HighPrevious Version Dangerous Deltainstall-cb.js

MediumNetwork

LowScripts Present

LowFilesystem