spectral-core (npm) typosquat: install-time script steals env secrets and AWS metadata
Severity: critical · Patch status: no-fix-needed · Since 2026-10-29
The npm package spectral-core, a typosquat resembling the legitimate @stoplight/spectral-core, was published with malicious install-time code. Versions 3.0.2–3.0.7 and 3.0.9–3.0.12 ship only package.json and a binding.gyp with gypfile:true, so npm runs node-gyp rebuild on install; a 'none'-type target executes an embedded node -e script. The script reads /proc/1/environ and /proc/self/environ (container/CI secrets and cloud credentials), gathers DNS/socket/ARP/route reconnaissance, queries the AWS EC2 metadata service at 169.254.169.254 for user-data and meta-data, and POSTs everything to a hardcoded webhook.site collector. The package ships no library functionality (declared index.js is absent), so its sole purpose is credential exfiltration. No patched versions exist; the fix is to not use the package.
What to do
- Check lockfiles and CI logs for any install of spectral-core versions 3.0.2–3.0.12 and remove it; treat any machine or CI runner that installed it as compromised
- Rotate all credentials present in environment variables on affected hosts, especially CI/CD secrets and AWS keys; invalidate EC2 instance roles and session tokens
- Audit AWS CloudTrail and webhook.site-related egress for exfiltration; block webhook.site and the metadata endpoint abuse patterns
- Pin dependencies and use the scoped @stoplight/spectral-core instead
- Enable npm install scripts restrictions (e.g. --ignore-scripts) and registry allowlists in CI
Sources
All live incidents on Threat Watch
