Critical Vulnerability in alexa-cybertron-team-code-review-agent: Malicious Code Execution
Summary
MAL-2026-17430: Malicious code in alexa-cybertron-team-code-review-agent (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The alexa-cybertron-team-code-review-agent is an npm package that is designed for code review automation within the Alexa Cybertron team. It mimics the name of an internal project, which can mislead users into believing it is a legitimate package. The package has been identified as a dependency-confusion package, which poses significant security risks.
Vulnerability Detail
The vulnerability arises from the package's preinstall script, which executes 'node setup.js || true' during installation. This script sends sensitive information, including hostname, username, working directory, OS, architecture, Node.js version, and npm registry details, to a remote server. The package uses an inflated version number (100.0.0) to outrank legitimate private registry versions, making it more likely to be installed unintentionally. This malicious behavior can lead to data leakage and unauthorized access to user environments.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall alexa-cybertron-team-code-review-agentIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, avoid installing the alexa-cybertron-team-code-review-agent package. If it is already installed, remove it immediately and monitor your environment for any unauthorized access or data leaks.
Conclusion
The alexa-cybertron-team-code-review-agent package poses a significant security risk due to its malicious preinstall script that collects sensitive information. Users are advised to uninstall the package and monitor their systems for any unauthorized access. Utilizing tools like Vulert can help in identifying such vulnerabilities in real-time.
See every vulnerability recorded for alexa-cybertron-team-code-review-agent →
FAQ
It is an npm package intended for code review automation, but it has been identified as containing malicious code.
The vulnerability executes a preinstall script that sends sensitive user information to a remote server.
Using this package can lead to data leakage and unauthorized access to your system.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without needing to sign up.
Immediately uninstall the package using 'npm uninstall alexa-cybertron-team-code-review-agent' and monitor your environment for any suspicious activity.
