{
  "schema_version": "1.6.0",
  "id": "CLR-2026-3035",
  "modified": "2026-07-15T14:00:00Z",
  "published": "2026-07-15T14:00:00Z",
  "summary": "npm package that steals your SSH keys, AWS creds and npm token on npm install",
  "details": "The npm package none123s@1.1.7 has an empty description, no repository and ships just two files — a shell around a payload. Its package.json declares a prepare hook that runs index.js, which reads the host’s SSH private keys (id_rsa, id_ed25519), AWS credentials (~/.aws/credentials) and npm token (~/.npmrc), fingerprints the machine, and POSTs it all to an attacker-controlled ngrok tunnel at an endpoint literally named /exfil — a straight credential grab from any developer machine or CI runner that installs it.",
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "none123s"
      },
      "versions": [
        "1.1.7"
      ]
    }
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://research.codelake.dev/advisories/clr-2026-3035-none123s"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/MAL-2026-7024"
    }
  ],
  "credits": [
    {
      "name": "Sascha Klein, codelake Research",
      "type": "FINDER",
      "contact": [
        "https://research.codelake.dev"
      ]
    }
  ],
  "database_specific": {
    "caseId": "CLR-2026-3035",
    "kind": "malware",
    "class": "Install-time credential stealer",
    "severity": "Critical",
    "status": "Confirmed malicious",
    "iocs": {
      "ips": [],
      "hashes": [
        "sha256:081cdbf405bc6304aef014bb1418a716c4e6b83db53c551a73a3e3daabf4d793"
      ],
      "indicators": [
        "none123s@1.1.7 (npm) — empty description, no repository/homepage, 2-file shell",
        "081cdbf405bc6304aef014bb1418a716c4e6b83db53c551a73a3e3daabf4d793 (tarball)",
        "package.json: \"prepare\": \"node index.js || true\" — runs around install",
        "https://crabbing-thong-overhung.ngrok-free.dev — /ping (beacon), /exfil (upload)",
        "reads ~/.ssh/id_rsa, ~/.ssh/id_ed25519, ~/.aws/credentials, ~/.npmrc",
        "os.hostname() + host fingerprint",
        "MAL-2026-7024"
      ]
    }
  }
}