MAL-2026-10437

See a problem?

Import Source

https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/jsonfb/MAL-2026-10437.json

JSON Data

https://api.osv.dev/v1/vulns/MAL-2026-10437

Aliases

GHSA-86qc-ppwg-mgcj

Published

2026-07-13T09:17:31Z

Modified

2026-09-01T11:31:37Z

Summary

Malicious code in jsonfb (npm)

Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (7fc07bf73ed684a1d555baa4dc6cadcd170bde4da4779ef62c0dd3f9cf02c99a)

Package jsonfb@1.1.0 is presented as a JSON.parse bigint helper (mimicking json-bigint, and re-using the real json-bigint maintainer's name in package.json while the repository URL points at an unrelated org). The entire 471 KB index.js is packed with obfuscator.io (rotating 3004-entry string array, RC4-based string decoder, self-defending debugger check, control-flow flattening) that hides all require targets, destination URLs, and config keys. Behind the obfuscation, the module pulls vm, fs, os, http, https, crypto and implements fetchRemoteRiskCode, which HTTP-GETs base64-encoded JavaScript from a set of remoteCodeUrls, decodes it with Buffer.from(data.code,'base64'), and executes it via new vm.Script(code,{filename,timeout}).runInContext(sandboxContext) inside a SandboxManager that exposes fs, os, path, child_process, http, and require to the fetched code. A startRiskCodePolling loop (default 30s) auto-starts when NODE_ENV=production or when RISK_CODE_AUTO_START is set. A companion remoteLog path builds HMAC-MD5-signed POSTs (signWithMD5 with hardcoded signSecretKey/signSecretValue) to remoteLogUrls to ship runtime state and sandbox output back to the operator. The obfuscation, the impersonated author identity, the typosquat name, and the require-time remote-code-execution + signed exfiltration channel together constitute a live C2/dropper delivered as a fake JSON parser.

Source: ghsa-malware (5903da304ed82b530bffd047b6d4ef1c4bd532fe1815540857a73a5f3aece882)

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Database specific

{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-010174",
            "import_time": "2026-07-13T10:37:34.826441672Z",
            "modified_time": "2026-07-13T09:17:31Z",
            "sha256": "7fc07bf73ed684a1d555baa4dc6cadcd170bde4da4779ef62c0dd3f9cf02c99a",
            "source": "amazon-inspector",
            "versions": [
                "1.1.0"
            ]
        },
        {
            "id": "IN-MAL-2026-010177",
            "import_time": "2026-07-13T10:37:35.080466974Z",
            "modified_time": "2026-07-13T09:17:54Z",
            "sha256": "98848bd28a5e3618e7db4e91a9186f70be344122f20a963317063ca52badd0b3",
            "source": "amazon-inspector",
            "versions": [
                "1.1.0-beta.1"
            ]
        },
        {
            "id": "IN-MAL-2026-010178",
            "import_time": "2026-07-13T10:37:35.16099686Z",
            "modified_time": "2026-07-13T09:18:02Z",
            "sha256": "cc9554116a6b3a8cb431a21bbfe2f603f8ace900d2f7da8aac59178461157c4f",
            "source": "amazon-inspector",
            "versions": [
                "1.1.0-beta.2"
            ]
        },
        {
            "id": "GHSA-86qc-ppwg-mgcj",
            "import_time": "2026-07-15T05:00:56.791199296Z",
            "modified_time": "2026-07-14T21:40:17Z",
            "ranges": [
                {
                    "events": [
                        {
                            "introduced": "0"
                        }
                    ],
                    "type": "SEMVER"
                }
            ],
            "sha256": "5903da304ed82b530bffd047b6d4ef1c4bd532fe1815540857a73a5f3aece882",
            "source": "ghsa-malware"
        },
        {
            "id": "IN-MAL-2026-010631",
            "import_time": "2026-07-15T08:51:04.927813258Z",
            "modified_time": "2026-07-15T08:06:19Z",
            "sha256": "307f2e80c8bd7309b0dbca5a550b834846239e00586b89125880d937d935a9d2",
            "source": "amazon-inspector",
            "versions": [
                "1.1.1"
            ]
        },
        {
            "id": "IN-MAL-2026-010658",
            "import_time": "2026-07-15T08:51:06.608709302Z",
            "modified_time": "2026-07-15T08:10:10Z",
            "sha256": "a52d38d14bdfe6bda3c78ca6a171ce66bb40bd285f7b349c271d759364e0c6ed",
            "source": "amazon-inspector",
            "versions": [
                "1.0.9"
            ]
        },
        {
            "id": "IN-MAL-2026-010657",
            "import_time": "2026-07-15T08:51:06.574577301Z",
            "modified_time": "2026-07-15T08:10:00Z",
            "sha256": "ab7a4f1cb35d5abb2872eb75e0d1157413568ae0d4e0e28baec8f02499d3cb17",
            "source": "amazon-inspector",
            "versions": [
                "1.0.7"
            ]
        },
        {
            "id": "IN-MAL-2026-010659",
            "import_time": "2026-07-15T08:51:06.660452967Z",
            "modified_time": "2026-07-15T08:10:18Z",
            "sha256": "eb1550e0681335d7266543b60b2a42563a2444397b744668de5258253836b766",
            "source": "amazon-inspector",
            "versions": [
                "1.0.8"
            ]
        },
        {
            "id": "RLMA-2026-05562",
            "import_time": "2026-07-20T13:14:48.390980034Z",
            "modified_time": "2026-07-20T10:47:40Z",
            "sha256": "747a210f3ca25c3ff0ae4962cd6a099f4d9ec141809c08866647adef1bb0b946",
            "source": "reversing-labs",
            "versions": [
                "1.0.0",
                "1.0.1",
                "1.0.2",
                "1.0.4",
                "1.0.5",
                "1.0.6"
            ]
        },
        {
            "id": "RLUA-2026-06291",
            "import_time": "2026-09-01T11:18:10.027976621Z",
            "modified_time": "2026-08-24T16:56:29Z",
            "sha256": "7b33182167a3d9ee514f9494fc5b9c91b0b6aa20b833ee3f81234517a679a2de",
            "source": "reversing-labs",
            "versions": [
                "1.0.3",
                "1.0.8",
                "1.1.0-beta.2",
                "1.1.0-beta.1",
                "1.1.1",
                "1.0.9",
                "1.0.7",
                "1.1.0"
            ]
        }
    ]
}

References

Credits

- Amazon Inspector - FINDER
- - inspector-research@amazon.com
- ReversingLabs - FINDER
- - https://www.reversinglabs.com

Affected packages

npm / jsonfb

Package

Name: jsonfb; View open source insights on deps.dev
Purl: pkg:npm/jsonfb

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.0.0

1.0.1

1.0.2

1.0.3

1.0.4

1.0.5

1.0.6

1.0.7

1.0.8

1.0.9

1.1.0-beta.1

1.1.0-beta.2

1.1.0

1.1.1

Database specific

cwes

[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]

indicators

{
    "evidence_files": [
        {
            "path": "index.js",
            "sha256": "57f0f45bba6668ed3e98cbd6ea939501f03d5ca248f00489b5629d67d46f0ac6",
            "tlsh": "89a4c19467c0e40762cf0b53ff06bae9e56ba9b674c8a8478664799d25bc107c1f0ef0"
        },
        {
            "path": "package.json",
            "sha256": "776be8428a91158eef4e02cb7cfde8051e4a863708dbb5d85b6e3fd4293504e6",
            "tlsh": "cef0e230c174aea30add6b90ac9a2846a9434c679894fc283793111d9fee52f55fd2bc"
        }
    ],
    "package_integrity": [
        {
            "filename": "jsonfb-1.1.0-beta.1.tgz",
            "hashes": {
                "sha1": "095b89d4544d5c6fdaed3c138320f9a7825614a4",
                "sha512_sri": "sha512-lNBIS+g1L2vU1l6jjrXG4lGrctxDUJ9Ku3RzyAk5uUn3M3jvZV9tXSm+ik879K1xcrOOfxrdoM+FzU/8LiZPSg=="
            }
        }
    ]
}

source

"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/jsonfb/MAL-2026-10437.json"