Malicious Code Vulnerability in cma-self-hosted-sandbox-cf Package
Summary
MAL-2026-17190: Malicious code in cma-self-hosted-sandbox-cf (npm). Affects cma-self-hosted-sandbox-cf versions 1.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The cma-self-hosted-sandbox-cf package is an npm module designed for self-hosted sandboxing solutions. It is intended to provide a controlled environment for executing code safely. However, this package has been found to contain malicious code that compromises user data and system integrity, making it a significant security risk.
Vulnerability Detail
The vulnerability originates from a preinstall hook defined in the package's package.json file, which executes an index.js script during installation. This script collects sensitive information such as the machine's hostname, current user details, home directory, DNS server configurations, and contents of critical system files like /etc/passwd and /etc/hosts. The collected data is then sent via an HTTPS POST request to a hardcoded attacker-controlled domain. This behavior occurs automatically upon installation without any user interaction, posing a severe risk of data exfiltration and unauthorized access.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall cma-self-hosted-sandbox-cfIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can prevent the execution of the preinstall hook by using the following command: npm install --ignore-scripts cma-self-hosted-sandbox-cf. However, this does not eliminate the risk associated with the package itself.
Conclusion
The cma-self-hosted-sandbox-cf package contains a serious vulnerability that allows malicious code to exfiltrate sensitive information from users' systems. It is essential to update or remove the package to protect against potential data breaches.
See every vulnerability recorded for cma-self-hosted-sandbox-cf →
FAQ
The malicious code collects sensitive system information and sends it to an attacker-controlled server.
You can use Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without needing to sign up.
If you cannot update the package, consider removing it from your project to mitigate the risk.
Yes, you can use the npm install --ignore-scripts command to prevent the execution of the preinstall hook temporarily.
The vulnerability was discovered by Amazon Inspector, a security assessment service.
