MAL-2026-18220

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/skillward/MAL-2026-18220.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-18220
Aliases
  • GHSA-9wgc-5pgr-25p3
Published
2026-10-23T13:55:03Z
Modified
2026-10-29T14:30:44Z
Summary
Malicious code in skillward (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (6c3ad90106c904f14f7b4987775b3e5701d66fc6ca669f4de658dd442bfb9f61)

skillward ships a set of lint/scan rules under dist/rules/ that detect suspicious patterns in other code. SW003-encoded-payload.js contains detection logic that references Buffer.from/base64 decoding patterns as things to flag; SW007-suspicious-egress.js enumerates dynamic-DNS provider substrings (no-ip., hopto.org, duckdns) as indicators to match against scanned code. These strings appear as detection data inside a rules module, not as runtime behavior of the package itself: the package does not decode or execute any base64 payload, does not contact dynamic-DNS hosts, and has no install-time or import-time network, filesystem, or credential activity. The pattern matches the indicator-as-data shape of a defensive detection tool.

Source: ghsa-malware (b0f3fd922178c06b3eae3dfaaa0bce1469e7c2d70a010a6263b117e36874a72a)

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Database specific 
{
    "malicious-packages-origins":  [
        {
            "id":  "GHSA-9wgc-5pgr-25p3",
            "import_time":  "2026-10-23T14:29:34.128216389Z",
            "modified_time":  "2026-10-23T13:55:03Z",
            "sha256":  "b0f3fd922178c06b3eae3dfaaa0bce1469e7c2d70a010a6263b117e36874a72a",
            "source":  "ghsa-malware",
            "versions":  [
                "0.1.1"
            ]
        },
        {
            "id":  "GHSA-9wgc-5pgr-25p3",
            "import_time":  "2026-10-23T15:26:47.49536301Z",
            "modified_time":  "2026-10-23T14:55:41Z",
            "sha256":  "5339da12e353ad564b4624621ea5fd2ad0013809799e522ba42871923af10c3c",
            "source":  "ghsa-malware",
            "versions":  [
                "0.1.2",
                "0.1.1"
            ]
        },
        {
            "id":  "IN-MAL-2026-022134",
            "import_time":  "2026-10-29T14:14:28.71498707Z",
            "modified_time":  "2026-10-29T13:53:16Z",
            "sha256":  "6c3ad90106c904f14f7b4987775b3e5701d66fc6ca669f4de658dd442bfb9f61",
            "source":  "amazon-inspector",
            "versions":  [
                "0.1.1"
            ]
        },
        {
            "id":  "IN-MAL-2026-022133",
            "import_time":  "2026-10-29T14:14:28.624814158Z",
            "modified_time":  "2026-10-29T13:53:08Z",
            "sha256":  "6c7bb80d99fd671e41d26f73197b4e0f0a80ba6ea6484d7acd88f1f0799c3b4a",
            "source":  "amazon-inspector",
            "versions":  [
                "0.1.2"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / skillward

Package

Name
skillward
View open source insights on deps.dev
Purl
pkg:npm/skillward

Affected ranges

Affected versions

0.*
0.1.1
0.1.2

Database specific

cwes 
[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files":  [
        {
            "path":  "dist/rules/SW003-encoded-payload.js",
            "sha256":  "3d626ef724a176ff2bd6bb4babb6fc6292c58284264abff41c59a72405973993",
            "tlsh":  "a652b5500cb7416647d390bc63436609a93f96673904ed89beac93840f558aee2fb3fc"
        },
        {
            "path":  "dist/rules/SW007-suspicious-egress.js",
            "sha256":  "4d11f98c63de36f400e808bc485e32171d0cb73b7be7c98f7dba4be9c9819a98",
            "tlsh":  "c822b6b901ab4417429351ec168b6502ab3991073989eddc3f5cc2945f8ea7ca3fb7ec"
        }
    ],
    "package_integrity":  [
        {
            "filename":  "skillward-0.1.1.tgz",
            "hashes":  {
                "sha1":  "967b71dd228aad0810278ade35da037720c5317e",
                "sha512_sri":  "sha512-FB17Co1WNDGqUC2+nRLXvHGxIsgvvUliB7JldUhLEe8an5SNteED4V9ajB7l4NBaWX4qcgjsAiEd6oZwU7ObgA=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/skillward/MAL-2026-18220.json"