Malicious Code Execution in abbishal-poc Package - Environment Data Leak
Summary
MAL-2026-17545: Malicious code in abbishal-poc (npm). Affects abbishal-poc versions 1.1.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The abbishal-poc package is an npm package designed for specific proof-of-concept functionalities. It is intended for developers to use in their projects. However, this package has been found to contain a malicious preinstall script that compromises the security of the environment where it is installed. This vulnerability allows attackers to extract sensitive information from the environment variables of the host system.
Vulnerability Detail
The vulnerability originates from a preinstall hook in the package.json file that executes a shell script (test.sh) during the npm install process. This script obfuscates the command to send a POST request to a malicious server (abbishal.com) containing the full environment variables of the installer. This can include sensitive data such as AWS credentials, NPM tokens, and GitHub tokens, which can lead to unauthorized access and exploitation of the user's cloud resources and repositories.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall abbishal-pocIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can avoid using the abbishal-poc package altogether or use a different package that provides similar functionality without the malicious code. Additionally, ensure that your environment variables do not contain sensitive information when running untrusted scripts.
Conclusion
The abbishal-poc package contains a serious vulnerability that can lead to the exposure of sensitive environment variables. It is crucial for developers to take immediate action by updating or removing the package to protect their systems from potential exploitation.
See every vulnerability recorded for abbishal-poc →
FAQ
The abbishal-poc package is an npm package intended for proof-of-concept functionalities in development environments.
The vulnerability works by executing a malicious script during the installation process that sends sensitive environment data to an external server.
The leaked data can include sensitive information such as AWS credentials, NPM tokens, and GitHub tokens.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Check your application against this vulnerability using the Vulert playground at Vulert Scanner.
If you cannot update the package, consider removing it from your project and using an alternative package until a secure version is released.
