spectral-net-probe (npm): malicious package exfiltrates local file contents via install-time and load-time callbacks
Severity: critical · Patch status: no-fix-needed · Since 2026-10-29
GitHub Advisory Database (via OpenSSF) reports malicious code in the npm package spectral-net-probe, which contains no functional code. Versions 1.0.1 and 1.0.4 run a postinstall script that beacons to Cloudflare quick tunnels; version 1.0.10 executes on package load, fetching instructions from http://154.57.164.64:30664 and http://127.0.0.1:3000, reading up to ten local files whose paths are returned in data.cargohold, and uploading the first 400 characters of each file to the same hosts. The package was published by npm account kristol07, which also published phantom-chartwinds and phantom-powder-keg the same day. No patched versions exist; affected users must remove the package and investigate for file exfiltration.
What to do
- Remove spectral-net-probe from all projects and lockfiles; block versions 1.0.1, 1.0.4 and 1.0.10
- Audit systems where it was installed for exfiltration of local file contents; block network access to 154.57.164.64:30664 and the listed trycloudflare.com hosts
- Check whether phantom-chartwinds or phantom-powder-keg are in dependency trees and remove them
- Review npm install logs and CI caches for the package; rotate any secrets readable from files on affected machines
Sources
All live incidents on Threat Watch
