{
  "affected": [
    {
      "database_specific": {
        "cwes": [
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          },
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          },
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          },
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          },
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          },
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          },
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          }
        ],
        "indicators": {
          "evidence_files": [
            {
              "path": "install-cb.js",
              "sha256": "051e6a7d32321dba37a5f64d67e3b5e108f8eafea2d43e60d6d1dd5ad0c5e9dc",
              "tlsh": "de4152ced1f6b0a553b2b3a8c22f03193563c1c74949de24fd9d43626f604782a218ed"
            },
            {
              "path": "package.json",
              "sha256": "455501c6655f9392fa4fdbcbad525687f4321a19670152ee5f289f73e7d789ee",
              "tlsh": "e8f08b258935a5231ac627a058197045b2e34d4b411cfc2c27df043ed28e66f157f7ba"
            }
          ],
          "package_integrity": [
            {
              "filename": "merge-grid-stats-1.2.0.tgz",
              "hashes": {
                "sha1": "05255762f00beb66f8f7a895da4e85256c43dc20",
                "sha512_sri": "sha512-w9YFM6f+znQk0IVl9jIw15jxLTNbvA1VHhxh+ufNdUUqlvQ5BZex9MB2ExQbE7lCTKYK2M0jI/bUTyapvNgqug=="
              }
            }
          ]
        }
      },
      "package": {
        "ecosystem": "npm",
        "name": "merge-grid-stats"
      },
      "versions": [
        "1.2.0",
        "1.3.0",
        "1.4.0",
        "1.5.0",
        "1.1.0",
        "1.0.1",
        "1.0.0"
      ]
    }
  ],
  "credits": [
    {
      "contact": [
        "inspector-research@amazon.com"
      ],
      "name": "Amazon Inspector",
      "type": "FINDER"
    }
  ],
  "database_specific": {
    "malicious-packages-origins": [
      {
        "id": "IN-MAL-2026-016857",
        "import_time": "2026-08-07T00:59:22.389263602Z",
        "modified_time": "2026-08-06T23:57:57Z",
        "sha256": "480edc24e9ce55e418b450a537402834259af05ee7f4b8e37a2d567c88c16d33",
        "source": "amazon-inspector",
        "versions": [
          "1.2.0"
        ]
      },
      {
        "id": "IN-MAL-2026-016856",
        "import_time": "2026-08-07T00:59:22.293674868Z",
        "modified_time": "2026-08-06T23:57:50Z",
        "sha256": "f32ba46f634d1cc25a1f23c2e6750d48df721cda4255e15308ed7861753bc1fe",
        "source": "amazon-inspector",
        "versions": [
          "1.3.0"
        ]
      },
      {
        "id": "IN-MAL-2026-016855",
        "import_time": "2026-08-07T00:59:22.201448023Z",
        "modified_time": "2026-08-06T23:57:40Z",
        "sha256": "65aa3700b74bc0d50e4a4ee4fb3b903af0ac2ebea5867a3d1ffd0876647ec2a1",
        "source": "amazon-inspector",
        "versions": [
          "1.4.0"
        ]
      },
      {
        "id": "IN-MAL-2026-016853",
        "import_time": "2026-08-07T00:59:22.028764828Z",
        "modified_time": "2026-08-06T23:57:08Z",
        "sha256": "8acac0f86860c41407583785cf4111e1ed3603c089fdafc43f13b67555b44530",
        "source": "amazon-inspector",
        "versions": [
          "1.5.0"
        ]
      },
      {
        "id": "IN-MAL-2026-016858",
        "import_time": "2026-08-07T00:59:22.487659167Z",
        "modified_time": "2026-08-06T23:58:04Z",
        "sha256": "9ee8fb4f530a10ef6654671f16801c19a5d6b62341236e768aa427d99ae3f99b",
        "source": "amazon-inspector",
        "versions": [
          "1.1.0"
        ]
      },
      {
        "id": "IN-MAL-2026-016859",
        "import_time": "2026-08-07T00:59:22.599171846Z",
        "modified_time": "2026-08-06T23:58:14Z",
        "sha256": "c2667c86658cd12a305c38bd9930970107e85438ce0063384d7be66035351f8a",
        "source": "amazon-inspector",
        "versions": [
          "1.0.1"
        ]
      },
      {
        "id": "IN-MAL-2026-016860",
        "import_time": "2026-08-07T00:59:22.692267008Z",
        "modified_time": "2026-08-06T23:58:22Z",
        "sha256": "c6b4931ac12bfa5bdfdb7880717cb59543e10e5924c97110a7671162e814d4c7",
        "source": "amazon-inspector",
        "versions": [
          "1.0.0"
        ]
      }
    ]
  },
  "details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (65aa3700b74bc0d50e4a4ee4fb3b903af0ac2ebea5867a3d1ffd0876647ec2a1)\nPackage advertises itself as a 2048-style grid game statistics utility, but its declared postinstall hook (`node install-cb.js`) executes on `npm install` and performs behavior unrelated to that purpose. The postinstall shells out via execSync to run `uname -a` and `id`, reads `/proc/1/cgroup` and `/proc/mounts`, inspects Linux capabilities, checks for `/var/run/docker.sock`, and reads the Kubernetes service-account token and namespace at `/var/run/secrets/kubernetes.io/serviceaccount/`. It also enumerates `/`, `/root`, `/root/projects`, performs a host write-test, inspects network configuration, and greps the process environment for variables matching `token|secret|key|password|db_|redis|s3` and related patterns. The collected data (including the k8s SA token length and env keys) is written to `NCODE_ESCAPE.txt` in the current working directory and two parent directories. Author metadata is placeholder-shaped (`merge-tools \u003cmerge-tools@example.com\u003e`) and the README/behavior mismatch indicates a cover-story shape. The install-time read of an installer-owned Kubernetes service-account token plus environment secret enumeration constitutes installer-side credential access and container-escape reconnaissance staging.\n",
  "id": "MAL-2026-13484",
  "modified": "2026-08-07T01:01:11Z",
  "published": "2026-08-06T23:57:08Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/merge-grid-stats/v/1.2.0"
    },
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/merge-grid-stats/v/1.3.0"
    },
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/merge-grid-stats/v/1.4.0"
    },
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/merge-grid-stats/v/1.5.0"
    },
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/merge-grid-stats/v/1.1.0"
    },
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/merge-grid-stats/v/1.0.1"
    },
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/merge-grid-stats/v/1.0.0"
    }
  ],
  "schema_version": "1.7.4",
  "summary": "Malicious code in merge-grid-stats (npm)"
}