Malicious code in chart-data-utils (npm)
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (3980b39b1ba77c4c8df0b8e08016a299640a60b6255c1ea8be1883343ec750e9) chart-data-utils@1.0.0 advertises itself as a chart data/color helper library (index.js contains only trivial color utilities), but ships a postinstall.js that runs at npm install time and performs credential harvesting and host reconnaissance. The postinstall shells out via child_process.exec to: (1) collect hostname, whoami/id output, Docker/cgroup indicators, sudo -ln, ps aux, ip addr/route; (2) enumerate process environment variables and grep-filter for KEY|TOKEN|SECRET|CREDENTIAL|NPM_TOKEN|AWS_|AZURE|GCP|GITHUB_TOKEN plus GitHub Actions identity fields (GITHUB_TOKEN, GITHUB_REPOSITORY, GITHUB_ACTOR, RUN_ID); (3) probe cloud instance-metadata endpoints at 169.254.169.254 (AWS), 100.100.100.200 (Aliyun), metadata.google.internal (GCP), metadata.tencentyun.com (Tencent), and an internal host tst.woa.com; (4) base64-encode the collected data and POST/GET it over plain HTTP to the hardcoded Burp Collaborator subdomain pzs5w7ntzhsnepwk564lyfdci3oucl0a.oastify.com. The package name/description are a cover story for a CI credential harvester; Chinese-language comments ("分片回传版") in the postinstall reference tst.woa.com.
MAL-2026-12350
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:MAL-2026-12350
chart-data-utils
Source reference: /affected/0/package/name
- Affected versions
- 1.0.0
Source reference:
/affected/0/versions - Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"package": {
"name": "chart-data-utils",
"purl": "pkg:npm/chart-data-utils",
"ecosystem": "npm"
},
"versions": [
"1.0.0"
],
"database_specific": {
"cwes": [
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
}
],
"source": "https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/chart-data-utils/MAL-2026-12350.json",
"indicators": {
"evidence_files": [
{
"path": "postinstall.js",
"tlsh": "cc71f2c4da6cb837333ad550e65a48075e87e8af4eb8ff8158362e20010cb463677a77",
"sha256": "b0fd56908ccfeea473ff249ab63aa2d4eb43d34dc160c2f9da94836587a5cb84"
},
{
"path": "package.json",
"tlsh": "13e07d30e91096332dc597a92d97c2013b315d0712083c4817972518439f2f1e0ffb1d",
"sha256": "77a52dfc0e1a660cb457ebfbc70984acce594f37af10c0519c366c6d5f16ba15"
}
],
"package_integrity": [
{
"hashes": {
"sha1": "701a44eee22ef2e3819a1d6df5d544fbc45d2473",
"sha512_sri": "sha512-crHgDGf2OG9zQ0IHRk362t23rdcRxrJnyJigiGSGjtmGwEuz5qqAsKPjY+1y6AJAIWQKKpyWTXdKK4zmG5O7dg=="
},
"filename": "chart-data-utils-1.0.0.tgz"
}
]
}
}
}
]Publisher severity
No explicit severity was provided.
- Event
- #10987 · Revision 1
- Added to Heist Feed
- Publisher date