{
  "schema_version": "1.6.0",
  "id": "CLR-2026-3038",
  "modified": "2026-07-20T00:00:00Z",
  "published": "2026-07-20T00:00:00Z",
  "summary": "supplyhub — a postinstall SSH-key & credential stealer",
  "details": "The npm package supplyhub@1.0.2 carries a postinstall lifecycle hook that runs on every npm install, before any of your own code. It reads the user's SSH private key (~/.ssh/id_rsa), the process environment (/proc/self/environ — where CI/cloud tokens live) and account/host details, then POSTs the lot to a hard-coded webhook.site dead-drop. Version 1.0.0 is clean — the theft was introduced in 1.0.2 (a trust-then-poison release pattern).",
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "supplyhub"
      },
      "versions": [
        "1.0.2"
      ]
    }
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://research.codelake.dev/advisories/clr-2026-3038-supplyhub"
    }
  ],
  "credits": [
    {
      "name": "Sascha Klein, codelake Research",
      "type": "FINDER",
      "contact": [
        "https://research.codelake.dev"
      ]
    }
  ],
  "database_specific": {
    "caseId": "CLR-2026-3038",
    "kind": "malware",
    "class": "Install-time credential / SSH-key stealer",
    "severity": "Critical",
    "status": "Confirmed malicious",
    "iocs": {
      "ips": [],
      "hashes": [
        "sha256:bd13913906ed463642719633f36f04cf10ae6f9c9360fcde842f8b6b1daf0b02",
        "sha256:734b2bce20972a628bc282177b29f5d293b1ced86f27901f0863ecfb796c4bc9"
      ],
      "indicators": [
        "https://webhook.site/3c9418b3-cacd-403d-b42e-e9e4a9508fe3 — exfil dead-drop (POST)",
        "postinstall.js reading ~/.ssh/id_rsa, /proc/self/environ, /etc/passwd · package.json scripts.postinstall = \"node postinstall.js\"",
        "1.0.2 (malicious): bd13913906ed463642719633f36f04cf10ae6f9c9360fcde842f8b6b1daf0b02",
        "1.0.0 (clean, for reference): 734b2bce20972a628bc282177b29f5d293b1ced86f27901f0863ecfb796c4bc9"
      ]
    }
  }
}