@dmangal/curse-dependent-ecto (npm): malicious install-time script exfiltrates env secrets and files via webhook.site
Severity: critical · Patch status: no-fix-needed · Since 2026-10-29
The npm package @dmangal/curse-dependent-ecto (versions 99999.0.0–99999.0.2) contains malicious code in its binding.gyp, which node-gyp executes automatically during npm install. The embedded node -e script greps /workspace/, /root/, /tmp/, /opt/, /var/ and /etc/ for files containing the 'HTB{' marker, reads /tmp/scent-trail.jsonl and /workspace/repo/package.json, enumerates all process.env keys, and POSTs the results (GREP:, FILE:, ALLENV: payloads) to a hardcoded webhook.site endpoint. The package has no native source files — binding.gyp exists solely to run the exfiltration command — and the implausible 99999.x version string suggests a dependency-confusion lure. Any developer or CI environment installing it leaks CI secrets, API tokens, environment-injected credentials and workspace file contents. No patched versions exist; the only fix is removal/blocking.
What to do
- Remove and uninstall @dmangal/curse-dependent-ecto from all projects and lockfiles; audit installs since exposure
- Rotate all CI secrets, API tokens and environment-injected credentials on any machine or runner that installed it
- Search logs and filesystems for files containing 'HTB{' and for outbound requests to webhook.site/89bd8fe7-328c-4e6d-970c-4d567b5a48a0
- Block the webhook.site endpoint and pin dependency versions; enable npm audit/registry malware scanning in CI
- Guard against dependency confusion by scoping internal package names in a private registry
Sources
All live incidents on Threat Watch
