MAL-2025-6214

Package exhibits multiple malicious behaviors: Office doc access/encryption, DB interaction, local storage clearing, arbitrary code execution, /dev/shm ref. The code includes a native bridge that allows it to execute arbitrary SQL queries on a mobile device’s database when used within a specific mobile application context. The ecmoaxmpp.umd.js file revealed a highly suspicious pattern. The code includes a function that checks if window.mappType is not equal to 'web'. When this condition is met, it proceeds to call window.$wv.databaseHandle, a function that acts as a bridge to a native mobile application. The methods invoked through this bridge include 'execute', 'rawQuery', 'rawInsert', 'rawUpdate', and 'rawDelete', all of which indicate direct, raw access to a mobile device’s database.