OpenSSF/OSV advisory MAL-2026-15633 confirms this npm version as malicious. The package's preinstall.js lifecycle script auto-executes on npm install and performs two attacker-benefiting actions against the installer. First, it enumerates process.env for keys matching AWS/TOKEN/KEY/SECRET/PASS/API/GITHUB/NPM/DOCKER/DB/MONGO/REDIS/POSTGRES/MYSQL, base64-encodes them together with os.hostname(), os.userInfo().username, __dirname, and CI-detection markers, and transmits the blob via curl to...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in spc-grafeno-login (npm)
Details
The package's preinstall.js lifecycle script auto-executes on npm install and performs two attacker-benefiting actions against the installer. First, it enumerates process.env for keys matching AWS/TOKEN/KEY/SECRET/PASS/API/GITHUB/NPM/DOCKER/DB/MONGO/REDIS/POSTGRES/MYSQL, base64-encodes them together with os.hostname(), os.userInfo().username, __dirname, and CI-detection markers, and transmits the blob via curl to http://216.126.236.46/r.php over plain HTTP. Second, on non-Windows hosts it spawns a reverse shell to 216.126.236.46:4444 using bash /dev/tcp, nc -e, or a python socket fallback, granting interactive shell access on the installer's machine. Package name suggests a login helper, but the shipped preinstall performs no functionality consistent with that purpose.
Decision reason
OpenSSF Malicious Packages via OSV confirms spc-grafeno-login@1.0.0 as malicious (MAL-2026-15633): Malicious code in spc-grafeno-login (npm)