Malicious Code Injection in abbishal-poc-as-dependency Package
Summary
MAL-2026-17653: Malicious code in abbishal-poc-as-dependency (npm). Affects abbishal-poc-as-dependency versions 1.3.0 – 1.3.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The abbishal-poc-as-dependency package is an npm library designed for dependency management in JavaScript applications. It is intended to facilitate the installation of packages without performing network requests or accessing the filesystem. However, it has been found to contain a malicious preinstall script that compromises the security of the environment it is installed in.
Vulnerability Detail
The vulnerability originates from a preinstall lifecycle script defined in the package's package.json file, which executes a shell script (test.sh) during the installation process. This script constructs a command that sends the entire environment variables of the installation context to a hardcoded external server (abbishal.com). This includes sensitive information such as CI tokens, cloud credentials, and npm publish tokens. The obfuscation of the command through variable fragmentation indicates a deliberate attempt to conceal malicious intent, contradicting the package's README that claims no network requests or data collection.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall abbishal-poc-as-dependencyIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid using the abbishal-poc-as-dependency package until it has been patched. You can also manually inspect the package's scripts and remove any malicious code before installation, although this is not recommended due to the risk of missing other vulnerabilities.
Conclusion
The abbishal-poc-as-dependency package contains a serious vulnerability that can expose sensitive information to external servers. It is crucial to update to the latest version to mitigate this risk. Additionally, utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for abbishal-poc-as-dependency →
FAQ
It is an npm package designed for dependency management in JavaScript applications, but it has been found to contain malicious code.
The vulnerability can expose sensitive environment variables to an external server, potentially leading to unauthorized access to your systems.
Yes, updating to the latest version of the abbishal-poc-as-dependency package will resolve the vulnerability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time using just your package-lock.json file.
You can check your application using the Vulert playground at Vulert Scanner without any signup.
