black-spindle-2 (npm): malicious postinstall beacon exfiltrates host data on install (no CVE)
Severity: critical · Patch status: no-fix-needed · Since 2026-10-29
The npm package black-spindle-2 (versions 100.0.0 and 301.0.0) contains malicious code flagged by Amazon Inspector and reported via OpenSSF/GitHub Advisory GHSA-qcg8-4xw5-5ccq. Its package.json declares a postinstall script that runs curl over plain HTTP against an anonymous ngrok-free.app tunnel (http://778e-181-63-25-28.ngrok-free.app), embedding a shell command-substitution expression in the URL path. The script fires automatically on npm install, confirming installation and providing a channel to exfiltrate host or environment values via the expanded shell expression; the shipped index.js is an empty stub, so the beacon is the package's entire effect. No patched versions exist; the fix is to remove the package. Anyone who installed these versions is affected.
What to do
- Search dependency trees and lockfiles for black-spindle-2 and remove it; do not install
- If installed, treat the build machine as compromised: rotate secrets, tokens, and environment credentials exposed during install
- Block ngrok-free.app tunnels in CI/build egress and disable install lifecycle scripts (npm config set ignore-scripts true)
- Audit npm install logs for connections to the ngrok host
- Prefer pinned dependencies and provenance-verified packages
Sources
All live incidents on Threat Watch
