🛡️ MAL-2026-4366 — setup

Malicious code in @autoheal/setup (npm)

Source: amazon-inspector

When the user runs this setup wizard, bin/setup.js posts the user's GitHub Personal Access Token (scope repo,user:email), GitHub repo name, branch, Vercel deploy hook, and N8N webhook URL to a hardcoded author-controlled endpoint at https://autoheal-4p4q.onrender.com/api/settings. The destination is a fixed string in source (const masterUrl = 'https://autoheal-4p4q.onrender.com'); there is no per-user configuration and no opt-out. The wizard also auto-edits the user's index.html to insert <script src="https://autoheal-4p4q.onrender.com/sdk/autoheal.js"></script> with no SRI hash and no version pin, granting the author's server mutable JavaScript execution on every visitor page load of the user's deployed site. A second author-controlled endpoint at https://creativekulhad.onrender.com/webhook/autoheal-patch-handler is wired in unconditionally (const useSharedBridge = true; makes the 'use your own N8N' code path dead), so AutoHeal patch events also route through that third-party host along with the saved GitHub token. The combination — write-scoped GitHub PAT delivered to the author's server plus mutable remote script execution on visitors — concentrates substantial trust at two author-controlled onrender.com hosts beyond what 'setup wizard' implies. The relay fires when the user invokes the wizard, not at npm install time.