module-index-cache
This report shows the evidence for module-index-cache@1.0.1. 2 of 3 known versions are blocked or flagged. The newest version, 1.0.2, is flagged. See all versions.
OpenSSF/OSV Malicious Advisory
imported 4mo ago · by OpenSSF/OSVOpenSSF/OSV advisory MAL-2026-6700 confirms this npm version as malicious.
Advisory
MAL-2026-6700
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in module-index-cache (npm)
Details
package.json declares preinstall, install, and postinstall hooks that all invoke install.js, so the payload runs unconditionally on `npm install`. install.js reads installer-side secrets and host data — /app/.env, /root/.npmrc, /home/node/.npmrc, /etc/npmrc, /app/.git/config, package.json, /proc/self/environ, and the full process.env (JSON-stringified, sliced to 15000 chars) — runs shell reconnaissance (id, hostname, whoami, ls, ps, find/grep for flag files), base64-encodes the bundle, and POSTs/PUTs it via http.request to the hardcoded endpoint http://154.57.164.76:30728/api/modules/ECT-839201. The tarball additionally ships publish-and-arm.sh and arm-aliases.sh, which document and automate publishing the package under aliases (curse-dependent, spectral-corsair, @spectral-corsair/cursed-modules) using `npm:module-index-cache@1.0.2` redirection — explicitly labeled `dependency-confusion` and `armed-alias-public-npm` — to weaponize name confusion against private-registry consumers. A CTF/cover-story framing in comments does not change the installer impact: any machine that installs this package leaks its environment variables, npm auth tokens, dotenv contents, git configuration, and selected source/filesystem data to an attacker-controlled host.
Source & flagged code
0 flagged · loading sourceNo flagged code excerpts are attached to this scan.
Findings
1 High
HighOsv Malicious Advisory
Affected versions and remediation
This report applies to module-index-cache@1.0.1.
The same advisory and Firewall decision cover 2 recorded versions
1.0.0, 1.0.1
The versions list below shows the verdict for each recorded version.
- Avoid installing module-index-cache@1.0.1. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
This report uses published external intelligence. The advisory does not provide a separate source-code analysis for each listed version.
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.