⛔ Malware Advisory Detected 2026-07-20 UTC
Confirmed malicious. codelake independently detected this at 2026-07-20 UTC — codelake is the source of record — not present in OSV at detection (novel first-catch). Now published in the OSV/OpenSSF malicious-packages database as MAL-2026-11043 (from the codelake report, merged 2026-07-24) — codelake remains the source of record.. Not yet in any public advisory database at detection time — codelake is the source of record.
Advisory · CLR-2026-3038

supplyhub — a postinstall SSH-key & credential stealer

The npm package [email protected] carries a postinstall lifecycle hook that runs on every npm install, before any of your own code. It reads the user's SSH private key (~/.ssh/id_rsa), the process environment (/proc/self/environ — where CI/cloud tokens live) and account/host details, then POSTs the lot to a hard-coded webhook.site dead-drop. Version 1.0.0 is clean — the theft was introduced in 1.0.2 (a trust-then-poison release pattern).

CriticalConfirmed maliciousAI + IOC verifiedNovel — not in OSV
Summary

A credential-exfiltration package. On npm install, supplyhub's postinstall hook (node postinstall.js) executes automatically — before the package is ever imported — and steals the developer's / CI runner's secrets.

The affected version is 1.0.2. We hold 1.0.0 in our corpus and it is clean; the exfiltration code was added in the 1.0.2 release — the classic "publish a benign version to build trust, then poison a later one" pattern.

Technique / kill-chain

Described from structural analysis of the packed tarball — no working payload or reproduction is published.

1. Trigger. package.json declares scripts.postinstall = "node postinstall.js"; npm runs it on install.

2. Collection. postinstall.js uses fs.readFileSync to read ~/.ssh/id_rsa (the private SSH key) and /proc/self/environ (the full process environment — CI secrets, cloud tokens, npm tokens), and gathers account/host identity via os.userInfo() / hostname. It also references /etc/passwd.

3. Exfiltration. The collected data is sent by HTTP POST to a hard-coded webhook.site endpoint (a public request-catcher used here as an attacker dead-drop): https://webhook.site/3c9418b3-cacd-403d-b42e-e9e4a9508fe3.

Any workstation or CI runner that installs [email protected] (directly or transitively) hands its SSH key and environment secrets to the operator.

Indicators of Compromise
URLhttps://webhook.site/3c9418b3-cacd-403d-b42e-e9e4a9508fe3 — exfil dead-drop (POST)
FILEpostinstall.js reading ~/.ssh/id_rsa, /proc/self/environ, /etc/passwd · package.json scripts.postinstall = "node postinstall.js"
SHA1.0.2 (malicious): bd13913906ed463642719633f36f04cf10ae6f9c9360fcde842f8b6b1daf0b02
SHA1.0.0 (clean, for reference): 734b2bce20972a628bc282177b29f5d293b1ced86f27901f0863ecfb796c4bc9
Remediation
#ActionPriority
01 Rotate the SSH key immediately. If [email protected] was installed, treat ~/.ssh/id_rsa as compromised — generate a new keypair, replace it on every host/service that trusted the old one, and remove the old public key. Immediate
02 Rotate every environment secret reachable at install time — CI/cloud tokens, npm tokens, API keys — from a clean machine. Immediate
03 Remove supplyhub and pin to a known-clean version / drop the dependency; block egress to the webhook.site endpoint. High
04 Run installs with --ignore-scripts in CI — the entire attack is a lifecycle hook. Hardening

Detected + classified independently by codelake Research via its install-hook behaviour pipeline — deterministic structural analysis of the packed tarball (package.json postinstall hook, ~/.ssh/id_rsa + /proc/self/environ reads, POST to a webhook.site dead-drop). Not present in OSV at time of detection — codelake is the source of record.

This is a confirmed-malware advisory. No working payload or reproduction is published — the behaviour is described from structural analysis, and the exfil endpoint is named as a defensive indicator only. The original artifact is preserved in the codelake archive and available to verified security researchers on request.