MAL-2026-10465

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/node-sysmon-native/MAL-2026-10465.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-10465
Published
2026-07-13T17:36:43Z
Modified
2026-07-13T18:16:55.603905696Z
Summary
Malicious code in node-sysmon-native (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (612887c8528ff96b3bc3a61d678b6376099480c080d2d8a0960fe7798ac25f33)

On module load, index.js reconstructs a hex-encoded URL (Buffer.from('687474703a2f2f3135322e35332e3132302e39302f636d64','hex')) that decodes to http://152.53.120.90/cmd and enters an asynchronous polling loop that GETs /commands from that host, executes each returned command via spawnSync('bash', ['-c', cmd]) with a 55-second timeout and 5MB output buffer, and POSTs the stdout, stderr, and exit code back to /results. Any consumer that require()s this package grants the operator of 152.53.120.90 arbitrary shell execution on the host, with output exfiltration. The destination is a bare IP address reconstructed at runtime from a hex string to hide it from static scanners, and the package's declared 'sysmon-native' purpose provides no legitimate reason for polling a hardcoded remote host for shell commands.

Database specific 
{
    "malicious-packages-origins": [
        {
            "sha256": "3f8a6c11a70645f277c02b86ac449237316b52e4e37b685526a0e2acccbaa305",
            "modified_time": "2026-07-13T17:36:51Z",
            "id": "IN-MAL-2026-010266",
            "source": "amazon-inspector",
            "versions": [
                "1.0.0"
            ],
            "import_time": "2026-07-13T18:10:12.099777135Z"
        },
        {
            "sha256": "612887c8528ff96b3bc3a61d678b6376099480c080d2d8a0960fe7798ac25f33",
            "modified_time": "2026-07-13T17:36:43Z",
            "id": "IN-MAL-2026-010265",
            "source": "amazon-inspector",
            "versions": [
                "1.0.1"
            ],
            "import_time": "2026-07-13T18:10:11.988402598Z"
        },
        {
            "sha256": "e1356ef95d176b270c43ef0f201811f2a3a958e537461de66496929e31369723",
            "modified_time": "2026-07-13T17:37:10Z",
            "versions": [
                "1.0.2"
            ],
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-010268",
            "import_time": "2026-07-13T18:10:12.234112449Z"
        }
    ]
}
References
Credits

Affected packages

npm / node-sysmon-native

Package

Name
node-sysmon-native
View open source insights on deps.dev
Purl
pkg:npm/node-sysmon-native

Affected ranges

Affected versions

1.*
1.0.0
1.0.1
1.0.2

Database specific

indicators 
{
    "evidence_files": [
        {
            "sha256": "afdc004c06a7a42f5763d83766e107cd24bc139c12cd714cec167ed0a5e19610",
            "tlsh": "404160e5e5aea8d5d2ef0b687343c5a0a15f610b12d6cd10fd8ea0981f4845492f3b6b",
            "path": "sysmon.cc"
        }
    ],
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-ll8+3SN4AupUubGSwGjMc4dOEovY69Q4txfxWOlLl0ahrTbm0SAzRCjCDYQNfHG3AN+rnDxyzlLQFMmvFsP9MA==",
                "sha1": "b13f0038b65cca5b9bde920c88eb757f1ea0e1bf"
            },
            "filename": "node-sysmon-native-1.0.0.tgz"
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    },
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/node-sysmon-native/MAL-2026-10465.json"